xmrig | f281e29e8e3b36850ccf005de5ffa18f1c2bdbb39ec65a2761ed0b5c8c4e2131

Analysis

max time kernel
29s
max time network
27s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
Size

1.9MB
MD5

0763d17d413584adff7649b9e37a8422
SHA1

2a1bfd4a628dd399807a7c3707f52817dce7a360
SHA256

f281e29e8e3b36850ccf005de5ffa18f1c2bdbb39ec65a2761ed0b5c8c4e2131
SHA512

7705a14d0ef22e9a315d5cdea03758c5d55ababb33ed51faf133cb52e898f9716619f08ac91a47ae9971bd623f45e7e121605c0de4ac30c5cb1fb945b3f2d48e
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+US:NABH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2720-27-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2504-52-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2984-61-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/1996-87-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2472-47-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2636-30-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2540-29-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2200-21-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2624-1914-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2984-1929-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/1732-2438-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2540	BCTGedm.exe
2200	drWvdBy.exe
2636	gdsDXJj.exe
2720	VsQTIGf.exe
2472	NAKHSbs.exe
2504	kTFZxll.exe
2624	jomEarg.exe
2984	eSVjxxo.exe
1732	bIfhHsu.exe
2856	BaHkhVG.exe
2836	iREGwDI.exe
2972	TdvwuJP.exe
764	iPZyUgr.exe
2036	YMuSzSD.exe
2016	TkpeTsx.exe
768	EnuECjy.exe
816	zjVgjUx.exe
2848	QYzPjLm.exe
2680	dZhyEhY.exe
2340	pFaMHdh.exe
2296	SIMsaUJ.exe
2148	PRAInMN.exe
2916	ulcNSNb.exe
776	rBZyexY.exe
2076	XvcYEqe.exe
1304	celTGIU.exe
652	JGbsgWf.exe
1876	Awastli.exe
1880	LkrMyOa.exe
1096	cMYhdCl.exe
2264	hQBYmHB.exe
1740	GZQvMSk.exe
964	ORVmCAg.exe
1888	XqhzCzb.exe
1952	WabcUea.exe
928	QQwwfrD.exe
2320	WRRvuBo.exe
1548	AouYiFg.exe
2316	RialJvP.exe
2328	NPieTYe.exe
1236	tCnAthA.exe
2108	ZhwiOQw.exe
1596	jmQfyci.exe
2608	UdnZgCT.exe
2800	DosDtnY.exe
2444	CBtaMoE.exe
2828	MVDFKeW.exe
3032	TRygVPL.exe
2692	PBggJZb.exe
2044	RmAQiAu.exe
2260	pPVAAKz.exe
2156	bvlIwrY.exe
1832	moaJfOx.exe
1652	BwhbygI.exe
2120	TSQnGWU.exe
2248	lsJsdyN.exe
1448	MSPuWGu.exe
2868	QUJQlGR.exe
2452	aQJadyc.exe
1940	IhUHdSd.exe
1776	ATRNCGi.exe
3104	SgrKyuI.exe
3136	uhSpdyD.exe
3168	Qndvbqz.exe

Loads dropped DLL 64 IoCs

pid	Process
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000144e0-2.dat	upx
behavioral1/files/0x003600000001480e-13.dat	upx
behavioral1/files/0x0007000000014ba7-10.dat	upx
behavioral1/memory/2720-27-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x0007000000014eb9-38.dat	upx
behavioral1/files/0x00090000000153d9-49.dat	upx
behavioral1/memory/2504-52-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2624-54-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/files/0x0006000000015cce-64.dat	upx
behavioral1/memory/1732-73-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/files/0x0006000000015ce3-70.dat	upx
behavioral1/memory/2984-61-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x0006000000015d0c-94.dat	upx
behavioral1/files/0x0006000000015d44-100.dat	upx
behavioral1/memory/2856-82-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x00060000000162c9-143.dat	upx
behavioral1/files/0x00360000000149e1-154.dat	upx
behavioral1/files/0x00060000000165f0-166.dat	upx
behavioral1/files/0x0006000000016c8c-190.dat	upx
behavioral1/files/0x000600000001654a-161.dat	upx
behavioral1/files/0x0006000000016476-159.dat	upx
behavioral1/files/0x0006000000016c42-185.dat	upx
behavioral1/files/0x0006000000016c1d-177.dat	upx
behavioral1/files/0x0006000000016813-171.dat	upx
behavioral1/files/0x0006000000016c3a-183.dat	upx
behavioral1/files/0x0006000000016a6f-175.dat	upx
behavioral1/files/0x00060000000161b3-137.dat	upx
behavioral1/files/0x0006000000015fa7-132.dat	upx
behavioral1/files/0x0006000000015e6d-129.dat	upx
behavioral1/files/0x0006000000015d4c-119.dat	upx
behavioral1/files/0x00060000000160cc-135.dat	upx
behavioral1/files/0x0006000000015d24-95.dat	upx
behavioral1/files/0x0006000000015f3c-124.dat	upx
behavioral1/memory/2972-90-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2836-89-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/memory/1996-87-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x0006000000015cf5-86.dat	upx
behavioral1/files/0x0006000000015cd9-85.dat	upx
behavioral1/files/0x0006000000015e09-114.dat	upx
behavioral1/files/0x0007000000015cbd-57.dat	upx
behavioral1/files/0x001800000000558a-39.dat	upx
behavioral1/memory/2472-47-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2636-30-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2540-29-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x0007000000014dae-23.dat	upx
behavioral1/memory/2200-21-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/memory/1996-8-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2624-1914-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2984-1929-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/1732-2438-0x000000013FF20000-0x0000000140312000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ngCjKjo.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\WnnltcY.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\YcBKYUz.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\VeWrnds.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\ABTMxlv.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\PbpDDpn.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\CeQfwYU.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\TWZuEwH.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\slQlOOs.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\tJUixEm.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\jNHZeXA.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\PRpuwqM.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\gGICHNK.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\AVfmtKc.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\CElGcPC.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\PxzMLpi.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\lghCGYp.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\WczMzTj.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\PfaMoGO.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\ATqmjzP.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\gWufpCf.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\hQBYmHB.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\vohraTm.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\fbRPwFt.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\CEEImvu.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\uAglwpt.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\TTndRzN.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\eNiJKgC.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\ktKZVKg.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\OiNrLyF.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\qBYMtGd.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\DosDtnY.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\sNInOYa.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\LfwSFUa.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\awMhCwT.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\lrSRMjY.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\IcIKRHh.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\xzpkExN.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\wPrizyf.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\CJyoPiR.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\twTRTks.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\cPRbFMR.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\JGbsgWf.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\qgfnhBN.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\xwjfDwb.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\VYqWGuY.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\eeWZYkn.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\xhcGxSQ.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\anOMuij.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\JWvuvMD.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\TxkJkRv.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\oLouSNo.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\bjQewzz.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\lsJsdyN.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\MuBaVTe.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\ECvhLSz.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\bCtYSDX.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\IAqcejO.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\JHLDzrZ.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\kItECTU.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\tUqjlDv.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\yaXbqWa.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\foqRnHU.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
File created	C:\Windows\System\DlDSGMr.exe	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1300	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
Token: SeDebugPrivilege	1300	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 1300	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	29
PID 1996 wrote to memory of 1300	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	29
PID 1996 wrote to memory of 1300	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	29
PID 1996 wrote to memory of 2540	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2540	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2540	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	30
PID 1996 wrote to memory of 2200	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	31
PID 1996 wrote to memory of 2200	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	31
PID 1996 wrote to memory of 2200	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	31
PID 1996 wrote to memory of 2636	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	32
PID 1996 wrote to memory of 2636	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	32
PID 1996 wrote to memory of 2636	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	32
PID 1996 wrote to memory of 2720	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	33
PID 1996 wrote to memory of 2720	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	33
PID 1996 wrote to memory of 2720	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	33
PID 1996 wrote to memory of 2472	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	34
PID 1996 wrote to memory of 2472	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	34
PID 1996 wrote to memory of 2472	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	34
PID 1996 wrote to memory of 2624	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	35
PID 1996 wrote to memory of 2624	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	35
PID 1996 wrote to memory of 2624	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	35
PID 1996 wrote to memory of 2504	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	36
PID 1996 wrote to memory of 2504	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	36
PID 1996 wrote to memory of 2504	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	36
PID 1996 wrote to memory of 2984	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	37
PID 1996 wrote to memory of 2984	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	37
PID 1996 wrote to memory of 2984	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	37
PID 1996 wrote to memory of 1732	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	38
PID 1996 wrote to memory of 1732	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	38
PID 1996 wrote to memory of 1732	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	38
PID 1996 wrote to memory of 2836	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	39
PID 1996 wrote to memory of 2836	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	39
PID 1996 wrote to memory of 2836	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	39
PID 1996 wrote to memory of 2856	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	40
PID 1996 wrote to memory of 2856	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	40
PID 1996 wrote to memory of 2856	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	40
PID 1996 wrote to memory of 2972	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	41
PID 1996 wrote to memory of 2972	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	41
PID 1996 wrote to memory of 2972	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	41
PID 1996 wrote to memory of 764	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	42
PID 1996 wrote to memory of 764	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	42
PID 1996 wrote to memory of 764	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	42
PID 1996 wrote to memory of 2016	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	43
PID 1996 wrote to memory of 2016	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	43
PID 1996 wrote to memory of 2016	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	43
PID 1996 wrote to memory of 2036	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	44
PID 1996 wrote to memory of 2036	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	44
PID 1996 wrote to memory of 2036	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	44
PID 1996 wrote to memory of 816	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	45
PID 1996 wrote to memory of 816	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	45
PID 1996 wrote to memory of 816	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	45
PID 1996 wrote to memory of 768	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	46
PID 1996 wrote to memory of 768	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	46
PID 1996 wrote to memory of 768	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	46
PID 1996 wrote to memory of 2680	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	47
PID 1996 wrote to memory of 2680	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	47
PID 1996 wrote to memory of 2680	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	47
PID 1996 wrote to memory of 2848	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	48
PID 1996 wrote to memory of 2848	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	48
PID 1996 wrote to memory of 2848	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	48
PID 1996 wrote to memory of 2340	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	49
PID 1996 wrote to memory of 2340	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	49
PID 1996 wrote to memory of 2340	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	49
PID 1996 wrote to memory of 2296	1996	0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0763d17d413584adff7649b9e37a8422_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System\BCTGedm.exe
  C:\Windows\System\BCTGedm.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\drWvdBy.exe
  C:\Windows\System\drWvdBy.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\gdsDXJj.exe
  C:\Windows\System\gdsDXJj.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\VsQTIGf.exe
  C:\Windows\System\VsQTIGf.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\NAKHSbs.exe
  C:\Windows\System\NAKHSbs.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\jomEarg.exe
  C:\Windows\System\jomEarg.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\kTFZxll.exe
  C:\Windows\System\kTFZxll.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\eSVjxxo.exe
  C:\Windows\System\eSVjxxo.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\bIfhHsu.exe
  C:\Windows\System\bIfhHsu.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\iREGwDI.exe
  C:\Windows\System\iREGwDI.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\BaHkhVG.exe
  C:\Windows\System\BaHkhVG.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\TdvwuJP.exe
  C:\Windows\System\TdvwuJP.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\iPZyUgr.exe
  C:\Windows\System\iPZyUgr.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\TkpeTsx.exe
  C:\Windows\System\TkpeTsx.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\YMuSzSD.exe
  C:\Windows\System\YMuSzSD.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\zjVgjUx.exe
  C:\Windows\System\zjVgjUx.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\EnuECjy.exe
  C:\Windows\System\EnuECjy.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\dZhyEhY.exe
  C:\Windows\System\dZhyEhY.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\QYzPjLm.exe
  C:\Windows\System\QYzPjLm.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\pFaMHdh.exe
  C:\Windows\System\pFaMHdh.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\SIMsaUJ.exe
  C:\Windows\System\SIMsaUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ulcNSNb.exe
  C:\Windows\System\ulcNSNb.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\PRAInMN.exe
  C:\Windows\System\PRAInMN.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\XvcYEqe.exe
  C:\Windows\System\XvcYEqe.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\rBZyexY.exe
  C:\Windows\System\rBZyexY.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\celTGIU.exe
  C:\Windows\System\celTGIU.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\JGbsgWf.exe
  C:\Windows\System\JGbsgWf.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\Awastli.exe
  C:\Windows\System\Awastli.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\LkrMyOa.exe
  C:\Windows\System\LkrMyOa.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\uTlDCcg.exe
  C:\Windows\System\uTlDCcg.exe
  2⤵
  PID:1948
- C:\Windows\System\cMYhdCl.exe
  C:\Windows\System\cMYhdCl.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\ZJNpYhH.exe
  C:\Windows\System\ZJNpYhH.exe
  2⤵
  PID:1532
- C:\Windows\System\hQBYmHB.exe
  C:\Windows\System\hQBYmHB.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\MyXedwD.exe
  C:\Windows\System\MyXedwD.exe
  2⤵
  PID:2012
- C:\Windows\System\GZQvMSk.exe
  C:\Windows\System\GZQvMSk.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\RtDNFCq.exe
  C:\Windows\System\RtDNFCq.exe
  2⤵
  PID:1560
- C:\Windows\System\ORVmCAg.exe
  C:\Windows\System\ORVmCAg.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\tBOuNAQ.exe
  C:\Windows\System\tBOuNAQ.exe
  2⤵
  PID:748
- C:\Windows\System\XqhzCzb.exe
  C:\Windows\System\XqhzCzb.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\LxuAAwV.exe
  C:\Windows\System\LxuAAwV.exe
  2⤵
  PID:1976
- C:\Windows\System\WabcUea.exe
  C:\Windows\System\WabcUea.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\lzioAGq.exe
  C:\Windows\System\lzioAGq.exe
  2⤵
  PID:1972
- C:\Windows\System\QQwwfrD.exe
  C:\Windows\System\QQwwfrD.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\ccJQQUm.exe
  C:\Windows\System\ccJQQUm.exe
  2⤵
  PID:3064
- C:\Windows\System\WRRvuBo.exe
  C:\Windows\System\WRRvuBo.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\FAdwTBH.exe
  C:\Windows\System\FAdwTBH.exe
  2⤵
  PID:2252
- C:\Windows\System\AouYiFg.exe
  C:\Windows\System\AouYiFg.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\DGTRrBI.exe
  C:\Windows\System\DGTRrBI.exe
  2⤵
  PID:1108
- C:\Windows\System\RialJvP.exe
  C:\Windows\System\RialJvP.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\reIrdUX.exe
  C:\Windows\System\reIrdUX.exe
  2⤵
  PID:1268
- C:\Windows\System\NPieTYe.exe
  C:\Windows\System\NPieTYe.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\TQMhUQX.exe
  C:\Windows\System\TQMhUQX.exe
  2⤵
  PID:1272
- C:\Windows\System\tCnAthA.exe
  C:\Windows\System\tCnAthA.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\BXeVnMR.exe
  C:\Windows\System\BXeVnMR.exe
  2⤵
  PID:2532
- C:\Windows\System\ZhwiOQw.exe
  C:\Windows\System\ZhwiOQw.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\TpjbolK.exe
  C:\Windows\System\TpjbolK.exe
  2⤵
  PID:2212
- C:\Windows\System\jmQfyci.exe
  C:\Windows\System\jmQfyci.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\XptZfUF.exe
  C:\Windows\System\XptZfUF.exe
  2⤵
  PID:1748
- C:\Windows\System\UdnZgCT.exe
  C:\Windows\System\UdnZgCT.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\CjBhvcX.exe
  C:\Windows\System\CjBhvcX.exe
  2⤵
  PID:988
- C:\Windows\System\DosDtnY.exe
  C:\Windows\System\DosDtnY.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\QNplDge.exe
  C:\Windows\System\QNplDge.exe
  2⤵
  PID:1772
- C:\Windows\System\CBtaMoE.exe
  C:\Windows\System\CBtaMoE.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\pWnhjZt.exe
  C:\Windows\System\pWnhjZt.exe
  2⤵
  PID:2460
- C:\Windows\System\MVDFKeW.exe
  C:\Windows\System\MVDFKeW.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\jVVZJEe.exe
  C:\Windows\System\jVVZJEe.exe
  2⤵
  PID:1008
- C:\Windows\System\TRygVPL.exe
  C:\Windows\System\TRygVPL.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\dVDpRDJ.exe
  C:\Windows\System\dVDpRDJ.exe
  2⤵
  PID:332
- C:\Windows\System\PBggJZb.exe
  C:\Windows\System\PBggJZb.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\GdWOWDp.exe
  C:\Windows\System\GdWOWDp.exe
  2⤵
  PID:2976
- C:\Windows\System\RmAQiAu.exe
  C:\Windows\System\RmAQiAu.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\hbCcEZG.exe
  C:\Windows\System\hbCcEZG.exe
  2⤵
  PID:2908
- C:\Windows\System\pPVAAKz.exe
  C:\Windows\System\pPVAAKz.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\lcNHwwC.exe
  C:\Windows\System\lcNHwwC.exe
  2⤵
  PID:896
- C:\Windows\System\bvlIwrY.exe
  C:\Windows\System\bvlIwrY.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\zNhddfQ.exe
  C:\Windows\System\zNhddfQ.exe
  2⤵
  PID:1296
- C:\Windows\System\moaJfOx.exe
  C:\Windows\System\moaJfOx.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\gguyLoC.exe
  C:\Windows\System\gguyLoC.exe
  2⤵
  PID:1392
- C:\Windows\System\BwhbygI.exe
  C:\Windows\System\BwhbygI.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\jfHxonB.exe
  C:\Windows\System\jfHxonB.exe
  2⤵
  PID:3060
- C:\Windows\System\TSQnGWU.exe
  C:\Windows\System\TSQnGWU.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\nNGiBtC.exe
  C:\Windows\System\nNGiBtC.exe
  2⤵
  PID:2196
- C:\Windows\System\lsJsdyN.exe
  C:\Windows\System\lsJsdyN.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\bDZzSLz.exe
  C:\Windows\System\bDZzSLz.exe
  2⤵
  PID:2128
- C:\Windows\System\MSPuWGu.exe
  C:\Windows\System\MSPuWGu.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\teGbyfi.exe
  C:\Windows\System\teGbyfi.exe
  2⤵
  PID:2616
- C:\Windows\System\QUJQlGR.exe
  C:\Windows\System\QUJQlGR.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\zTbHQzD.exe
  C:\Windows\System\zTbHQzD.exe
  2⤵
  PID:344
- C:\Windows\System\aQJadyc.exe
  C:\Windows\System\aQJadyc.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\ogxrcPC.exe
  C:\Windows\System\ogxrcPC.exe
  2⤵
  PID:1032
- C:\Windows\System\IhUHdSd.exe
  C:\Windows\System\IhUHdSd.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\FtCaGWK.exe
  C:\Windows\System\FtCaGWK.exe
  2⤵
  PID:1812
- C:\Windows\System\ATRNCGi.exe
  C:\Windows\System\ATRNCGi.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\VEkwHzM.exe
  C:\Windows\System\VEkwHzM.exe
  2⤵
  PID:3088
- C:\Windows\System\SgrKyuI.exe
  C:\Windows\System\SgrKyuI.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\IiIUSMg.exe
  C:\Windows\System\IiIUSMg.exe
  2⤵
  PID:3120
- C:\Windows\System\uhSpdyD.exe
  C:\Windows\System\uhSpdyD.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\BaseVTm.exe
  C:\Windows\System\BaseVTm.exe
  2⤵
  PID:3152
- C:\Windows\System\Qndvbqz.exe
  C:\Windows\System\Qndvbqz.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\fHbAlhd.exe
  C:\Windows\System\fHbAlhd.exe
  2⤵
  PID:3184
- C:\Windows\System\CeQfwYU.exe
  C:\Windows\System\CeQfwYU.exe
  2⤵
  PID:3200
- C:\Windows\System\TUndcnb.exe
  C:\Windows\System\TUndcnb.exe
  2⤵
  PID:3216
- C:\Windows\System\oTzecmA.exe
  C:\Windows\System\oTzecmA.exe
  2⤵
  PID:3232
- C:\Windows\System\KtRzCPK.exe
  C:\Windows\System\KtRzCPK.exe
  2⤵
  PID:3248
- C:\Windows\System\sAwDuEj.exe
  C:\Windows\System\sAwDuEj.exe
  2⤵
  PID:3264
- C:\Windows\System\VKbhZcF.exe
  C:\Windows\System\VKbhZcF.exe
  2⤵
  PID:3300
- C:\Windows\System\fpdwEOD.exe
  C:\Windows\System\fpdwEOD.exe
  2⤵
  PID:3316
- C:\Windows\System\RHSQlpC.exe
  C:\Windows\System\RHSQlpC.exe
  2⤵
  PID:3332
- C:\Windows\System\FALkpPY.exe
  C:\Windows\System\FALkpPY.exe
  2⤵
  PID:3348
- C:\Windows\System\nndwYVs.exe
  C:\Windows\System\nndwYVs.exe
  2⤵
  PID:3364
- C:\Windows\System\MZlTRdD.exe
  C:\Windows\System\MZlTRdD.exe
  2⤵
  PID:3380
- C:\Windows\System\ACVHPOl.exe
  C:\Windows\System\ACVHPOl.exe
  2⤵
  PID:3396
- C:\Windows\System\bCYaxgT.exe
  C:\Windows\System\bCYaxgT.exe
  2⤵
  PID:3412
- C:\Windows\System\RYPdLjZ.exe
  C:\Windows\System\RYPdLjZ.exe
  2⤵
  PID:3428
- C:\Windows\System\utiqFGQ.exe
  C:\Windows\System\utiqFGQ.exe
  2⤵
  PID:3444
- C:\Windows\System\szIKjou.exe
  C:\Windows\System\szIKjou.exe
  2⤵
  PID:3460
- C:\Windows\System\wQmjrIW.exe
  C:\Windows\System\wQmjrIW.exe
  2⤵
  PID:3476
- C:\Windows\System\XZxtblJ.exe
  C:\Windows\System\XZxtblJ.exe
  2⤵
  PID:3492
- C:\Windows\System\kfgVRiY.exe
  C:\Windows\System\kfgVRiY.exe
  2⤵
  PID:3508
- C:\Windows\System\yukRMIh.exe
  C:\Windows\System\yukRMIh.exe
  2⤵
  PID:3524
- C:\Windows\System\zErzWcC.exe
  C:\Windows\System\zErzWcC.exe
  2⤵
  PID:3540
- C:\Windows\System\VXVxjQv.exe
  C:\Windows\System\VXVxjQv.exe
  2⤵
  PID:3556
- C:\Windows\System\RsHMTXi.exe
  C:\Windows\System\RsHMTXi.exe
  2⤵
  PID:3576
- C:\Windows\System\YCJKSZz.exe
  C:\Windows\System\YCJKSZz.exe
  2⤵
  PID:3592
- C:\Windows\System\vtVqamn.exe
  C:\Windows\System\vtVqamn.exe
  2⤵
  PID:3608
- C:\Windows\System\HhjquXW.exe
  C:\Windows\System\HhjquXW.exe
  2⤵
  PID:3628
- C:\Windows\System\CJyoPiR.exe
  C:\Windows\System\CJyoPiR.exe
  2⤵
  PID:3684
- C:\Windows\System\ajBwTpn.exe
  C:\Windows\System\ajBwTpn.exe
  2⤵
  PID:3808
- C:\Windows\System\LXhAEjx.exe
  C:\Windows\System\LXhAEjx.exe
  2⤵
  PID:3876
- C:\Windows\System\jzAsNZI.exe
  C:\Windows\System\jzAsNZI.exe
  2⤵
  PID:3912
- C:\Windows\System\xhcGxSQ.exe
  C:\Windows\System\xhcGxSQ.exe
  2⤵
  PID:3940
- C:\Windows\System\xUcGRtG.exe
  C:\Windows\System\xUcGRtG.exe
  2⤵
  PID:3976
- C:\Windows\System\ojnbhdQ.exe
  C:\Windows\System\ojnbhdQ.exe
  2⤵
  PID:4008
- C:\Windows\System\aRIPxfB.exe
  C:\Windows\System\aRIPxfB.exe
  2⤵
  PID:4056
- C:\Windows\System\aiRqpbe.exe
  C:\Windows\System\aiRqpbe.exe
  2⤵
  PID:4092
- C:\Windows\System\TNbenDO.exe
  C:\Windows\System\TNbenDO.exe
  2⤵
  PID:3112
- C:\Windows\System\kQcqEgp.exe
  C:\Windows\System\kQcqEgp.exe
  2⤵
  PID:3240
- C:\Windows\System\SCGREUm.exe
  C:\Windows\System\SCGREUm.exe
  2⤵
  PID:348
- C:\Windows\System\XzmkwgF.exe
  C:\Windows\System\XzmkwgF.exe
  2⤵
  PID:1544
- C:\Windows\System\YWhljEg.exe
  C:\Windows\System\YWhljEg.exe
  2⤵
  PID:3280
- C:\Windows\System\gResrIF.exe
  C:\Windows\System\gResrIF.exe
  2⤵
  PID:3356
- C:\Windows\System\aeZKxcj.exe
  C:\Windows\System\aeZKxcj.exe
  2⤵
  PID:3424
- C:\Windows\System\zKJLNmJ.exe
  C:\Windows\System\zKJLNmJ.exe
  2⤵
  PID:3516
- C:\Windows\System\ijBgSZr.exe
  C:\Windows\System\ijBgSZr.exe
  2⤵
  PID:3588
- C:\Windows\System\PHrmONd.exe
  C:\Windows\System\PHrmONd.exe
  2⤵
  PID:3696
- C:\Windows\System\AtHTriW.exe
  C:\Windows\System\AtHTriW.exe
  2⤵
  PID:3720
- C:\Windows\System\xwjfDwb.exe
  C:\Windows\System\xwjfDwb.exe
  2⤵
  PID:3740
- C:\Windows\System\RUZawEI.exe
  C:\Windows\System\RUZawEI.exe
  2⤵
  PID:3760
- C:\Windows\System\VYqWGuY.exe
  C:\Windows\System\VYqWGuY.exe
  2⤵
  PID:3780
- C:\Windows\System\tdqjRZk.exe
  C:\Windows\System\tdqjRZk.exe
  2⤵
  PID:944
- C:\Windows\System\rmIjKgs.exe
  C:\Windows\System\rmIjKgs.exe
  2⤵
  PID:3884
- C:\Windows\System\xzpkExN.exe
  C:\Windows\System\xzpkExN.exe
  2⤵
  PID:3900
- C:\Windows\System\qGLRSrw.exe
  C:\Windows\System\qGLRSrw.exe
  2⤵
  PID:2136
- C:\Windows\System\cuxMesJ.exe
  C:\Windows\System\cuxMesJ.exe
  2⤵
  PID:2664
- C:\Windows\System\KtscrYl.exe
  C:\Windows\System\KtscrYl.exe
  2⤵
  PID:3964
- C:\Windows\System\DvBrGKR.exe
  C:\Windows\System\DvBrGKR.exe
  2⤵
  PID:2816
- C:\Windows\System\beDynfI.exe
  C:\Windows\System\beDynfI.exe
  2⤵
  PID:4016
- C:\Windows\System\szJJrqA.exe
  C:\Windows\System\szJJrqA.exe
  2⤵
  PID:2268
- C:\Windows\System\YVNqYyy.exe
  C:\Windows\System\YVNqYyy.exe
  2⤵
  PID:2064
- C:\Windows\System\SLzsERj.exe
  C:\Windows\System\SLzsERj.exe
  2⤵
  PID:2604
- C:\Windows\System\APVVnVN.exe
  C:\Windows\System\APVVnVN.exe
  2⤵
  PID:4024
- C:\Windows\System\pyFgizL.exe
  C:\Windows\System\pyFgizL.exe
  2⤵
  PID:2420
- C:\Windows\System\FpQQCxS.exe
  C:\Windows\System\FpQQCxS.exe
  2⤵
  PID:468
- C:\Windows\System\SvBqwlM.exe
  C:\Windows\System\SvBqwlM.exe
  2⤵
  PID:1684
- C:\Windows\System\EwxOaWB.exe
  C:\Windows\System\EwxOaWB.exe
  2⤵
  PID:1672
- C:\Windows\System\Vpuchpd.exe
  C:\Windows\System\Vpuchpd.exe
  2⤵
  PID:1840
- C:\Windows\System\STGghdV.exe
  C:\Windows\System\STGghdV.exe
  2⤵
  PID:3272
- C:\Windows\System\fwjQGkp.exe
  C:\Windows\System\fwjQGkp.exe
  2⤵
  PID:3504
- C:\Windows\System\TgWtrOo.exe
  C:\Windows\System\TgWtrOo.exe
  2⤵
  PID:3660
- C:\Windows\System\QZjncYq.exe
  C:\Windows\System\QZjncYq.exe
  2⤵
  PID:3816
- C:\Windows\System\JZGFjsE.exe
  C:\Windows\System\JZGFjsE.exe
  2⤵
  PID:1516
- C:\Windows\System\VoEfYve.exe
  C:\Windows\System\VoEfYve.exe
  2⤵
  PID:688
- C:\Windows\System\bLtaJXa.exe
  C:\Windows\System\bLtaJXa.exe
  2⤵
  PID:1700
- C:\Windows\System\FpGQMFZ.exe
  C:\Windows\System\FpGQMFZ.exe
  2⤵
  PID:3848
- C:\Windows\System\UcWRyZp.exe
  C:\Windows\System\UcWRyZp.exe
  2⤵
  PID:1936
- C:\Windows\System\Qynejcz.exe
  C:\Windows\System\Qynejcz.exe
  2⤵
  PID:3568
- C:\Windows\System\VwdSkRi.exe
  C:\Windows\System\VwdSkRi.exe
  2⤵
  PID:3648
- C:\Windows\System\pilBdLw.exe
  C:\Windows\System\pilBdLw.exe
  2⤵
  PID:1800
- C:\Windows\System\eHKnUzc.exe
  C:\Windows\System\eHKnUzc.exe
  2⤵
  PID:880
- C:\Windows\System\AxNOQrF.exe
  C:\Windows\System\AxNOQrF.exe
  2⤵
  PID:1524
- C:\Windows\System\avRzKpN.exe
  C:\Windows\System\avRzKpN.exe
  2⤵
  PID:1668
- C:\Windows\System\lCZrxJh.exe
  C:\Windows\System\lCZrxJh.exe
  2⤵
  PID:2732
- C:\Windows\System\ejycUIX.exe
  C:\Windows\System\ejycUIX.exe
  2⤵
  PID:1576
- C:\Windows\System\Iokkody.exe
  C:\Windows\System\Iokkody.exe
  2⤵
  PID:2548
- C:\Windows\System\LlXaZJq.exe
  C:\Windows\System\LlXaZJq.exe
  2⤵
  PID:636
- C:\Windows\System\hZQXkif.exe
  C:\Windows\System\hZQXkif.exe
  2⤵
  PID:2000
- C:\Windows\System\YYntwur.exe
  C:\Windows\System\YYntwur.exe
  2⤵
  PID:2876
- C:\Windows\System\mgCaSOu.exe
  C:\Windows\System\mgCaSOu.exe
  2⤵
  PID:3132
- C:\Windows\System\papKPaI.exe
  C:\Windows\System\papKPaI.exe
  2⤵
  PID:3196
- C:\Windows\System\SXfmLqu.exe
  C:\Windows\System\SXfmLqu.exe
  2⤵
  PID:3472
- C:\Windows\System\GAsydAx.exe
  C:\Windows\System\GAsydAx.exe
  2⤵
  PID:3984
- C:\Windows\System\aMgQwzr.exe
  C:\Windows\System\aMgQwzr.exe
  2⤵
  PID:4064
- C:\Windows\System\EWpuuER.exe
  C:\Windows\System\EWpuuER.exe
  2⤵
  PID:4080
- C:\Windows\System\CezAHoD.exe
  C:\Windows\System\CezAHoD.exe
  2⤵
  PID:3176
- C:\Windows\System\JmmmcfC.exe
  C:\Windows\System\JmmmcfC.exe
  2⤵
  PID:3212
- C:\Windows\System\WVTGXmv.exe
  C:\Windows\System\WVTGXmv.exe
  2⤵
  PID:3296
- C:\Windows\System\scUiaYz.exe
  C:\Windows\System\scUiaYz.exe
  2⤵
  PID:3388
- C:\Windows\System\zfgzSsJ.exe
  C:\Windows\System\zfgzSsJ.exe
  2⤵
  PID:3488
- C:\Windows\System\odjkrLr.exe
  C:\Windows\System\odjkrLr.exe
  2⤵
  PID:3552
- C:\Windows\System\kvHxrnY.exe
  C:\Windows\System\kvHxrnY.exe
  2⤵
  PID:3708
- C:\Windows\System\vIVwGuq.exe
  C:\Windows\System\vIVwGuq.exe
  2⤵
  PID:2896
- C:\Windows\System\Caqkplg.exe
  C:\Windows\System\Caqkplg.exe
  2⤵
  PID:3756
- C:\Windows\System\JsreYrf.exe
  C:\Windows\System\JsreYrf.exe
  2⤵
  PID:3776
- C:\Windows\System\VWbAzaM.exe
  C:\Windows\System\VWbAzaM.exe
  2⤵
  PID:2772
- C:\Windows\System\SiStsDK.exe
  C:\Windows\System\SiStsDK.exe
  2⤵
  PID:3896
- C:\Windows\System\sLpVvoU.exe
  C:\Windows\System\sLpVvoU.exe
  2⤵
  PID:3908
- C:\Windows\System\OSCbxMp.exe
  C:\Windows\System\OSCbxMp.exe
  2⤵
  PID:2668
- C:\Windows\System\nTGLVwK.exe
  C:\Windows\System\nTGLVwK.exe
  2⤵
  PID:3968
- C:\Windows\System\rWULrce.exe
  C:\Windows\System\rWULrce.exe
  2⤵
  PID:3956
- C:\Windows\System\MGvGGCQ.exe
  C:\Windows\System\MGvGGCQ.exe
  2⤵
  PID:4028
- C:\Windows\System\sNInOYa.exe
  C:\Windows\System\sNInOYa.exe
  2⤵
  PID:2024
- C:\Windows\System\gePHVKJ.exe
  C:\Windows\System\gePHVKJ.exe
  2⤵
  PID:4032
- C:\Windows\System\IDtCTlQ.exe
  C:\Windows\System\IDtCTlQ.exe
  2⤵
  PID:1552
- C:\Windows\System\eTzrTIi.exe
  C:\Windows\System\eTzrTIi.exe
  2⤵
  PID:320
- C:\Windows\System\CZVxuag.exe
  C:\Windows\System\CZVxuag.exe
  2⤵
  PID:3080
- C:\Windows\System\ymHFhiF.exe
  C:\Windows\System\ymHFhiF.exe
  2⤵
  PID:308
- C:\Windows\System\CtfMesg.exe
  C:\Windows\System\CtfMesg.exe
  2⤵
  PID:1708
- C:\Windows\System\ZcgalSy.exe
  C:\Windows\System\ZcgalSy.exe
  2⤵
  PID:2556
- C:\Windows\System\adodypn.exe
  C:\Windows\System\adodypn.exe
  2⤵
  PID:824
- C:\Windows\System\RUpisPE.exe
  C:\Windows\System\RUpisPE.exe
  2⤵
  PID:2140
- C:\Windows\System\pZNNxXT.exe
  C:\Windows\System\pZNNxXT.exe
  2⤵
  PID:2144
- C:\Windows\System\fEwsyOU.exe
  C:\Windows\System\fEwsyOU.exe
  2⤵
  PID:1712
- C:\Windows\System\DFspuiI.exe
  C:\Windows\System\DFspuiI.exe
  2⤵
  PID:3676
- C:\Windows\System\Dsttjwn.exe
  C:\Windows\System\Dsttjwn.exe
  2⤵
  PID:3656
- C:\Windows\System\bIVBIIK.exe
  C:\Windows\System\bIVBIIK.exe
  2⤵
  PID:1284
- C:\Windows\System\PyVOgJV.exe
  C:\Windows\System\PyVOgJV.exe
  2⤵
  PID:2764
- C:\Windows\System\oLouSNo.exe
  C:\Windows\System\oLouSNo.exe
  2⤵
  PID:2728
- C:\Windows\System\ltkMNpf.exe
  C:\Windows\System\ltkMNpf.exe
  2⤵
  PID:3820
- C:\Windows\System\pJfuRVh.exe
  C:\Windows\System\pJfuRVh.exe
  2⤵
  PID:2712
- C:\Windows\System\sAfKuQP.exe
  C:\Windows\System\sAfKuQP.exe
  2⤵
  PID:1356
- C:\Windows\System\IpjGgEJ.exe
  C:\Windows\System\IpjGgEJ.exe
  2⤵
  PID:3128
- C:\Windows\System\PkNimrC.exe
  C:\Windows\System\PkNimrC.exe
  2⤵
  PID:1964
- C:\Windows\System\DmSqWYJ.exe
  C:\Windows\System\DmSqWYJ.exe
  2⤵
  PID:3328
- C:\Windows\System\BojHXGw.exe
  C:\Windows\System\BojHXGw.exe
  2⤵
  PID:3376
- C:\Windows\System\VaDcNsT.exe
  C:\Windows\System\VaDcNsT.exe
  2⤵
  PID:2412
- C:\Windows\System\jLRaKNK.exe
  C:\Windows\System\jLRaKNK.exe
  2⤵
  PID:3992
- C:\Windows\System\ISbdqGC.exe
  C:\Windows\System\ISbdqGC.exe
  2⤵
  PID:1808
- C:\Windows\System\gQpCSNx.exe
  C:\Windows\System\gQpCSNx.exe
  2⤵
  PID:3936
- C:\Windows\System\pphxuBL.exe
  C:\Windows\System\pphxuBL.exe
  2⤵
  PID:1092
- C:\Windows\System\KKcegFr.exe
  C:\Windows\System\KKcegFr.exe
  2⤵
  PID:3208
- C:\Windows\System\zIiVdmd.exe
  C:\Windows\System\zIiVdmd.exe
  2⤵
  PID:3456
- C:\Windows\System\wYYyMuc.exe
  C:\Windows\System\wYYyMuc.exe
  2⤵
  PID:3744
- C:\Windows\System\oldqHmy.exe
  C:\Windows\System\oldqHmy.exe
  2⤵
  PID:2020
- C:\Windows\System\eUshork.exe
  C:\Windows\System\eUshork.exe
  2⤵
  PID:4048
- C:\Windows\System\XdrARlK.exe
  C:\Windows\System\XdrARlK.exe
  2⤵
  PID:3712
- C:\Windows\System\wYDgOad.exe
  C:\Windows\System\wYDgOad.exe
  2⤵
  PID:2872
- C:\Windows\System\eaqCgXm.exe
  C:\Windows\System\eaqCgXm.exe
  2⤵
  PID:3052
- C:\Windows\System\QGgQaxh.exe
  C:\Windows\System\QGgQaxh.exe
  2⤵
  PID:4084
- C:\Windows\System\fLNLCya.exe
  C:\Windows\System\fLNLCya.exe
  2⤵
  PID:3680
- C:\Windows\System\ITLGJuF.exe
  C:\Windows\System\ITLGJuF.exe
  2⤵
  PID:3016
- C:\Windows\System\tfGndgB.exe
  C:\Windows\System\tfGndgB.exe
  2⤵
  PID:1984
- C:\Windows\System\czROmbt.exe
  C:\Windows\System\czROmbt.exe
  2⤵
  PID:2892
- C:\Windows\System\arkgFdO.exe
  C:\Windows\System\arkgFdO.exe
  2⤵
  PID:3020
- C:\Windows\System\yHIBXZp.exe
  C:\Windows\System\yHIBXZp.exe
  2⤵
  PID:2928
- C:\Windows\System\bxEemah.exe
  C:\Windows\System\bxEemah.exe
  2⤵
  PID:2840
- C:\Windows\System\IBCihDk.exe
  C:\Windows\System\IBCihDk.exe
  2⤵
  PID:2808
- C:\Windows\System\pYOipNo.exe
  C:\Windows\System\pYOipNo.exe
  2⤵
  PID:3604
- C:\Windows\System\QItBZip.exe
  C:\Windows\System\QItBZip.exe
  2⤵
  PID:4044
- C:\Windows\System\IeHPhaf.exe
  C:\Windows\System\IeHPhaf.exe
  2⤵
  PID:2324
- C:\Windows\System\zsLFHAo.exe
  C:\Windows\System\zsLFHAo.exe
  2⤵
  PID:1396
- C:\Windows\System\eGKivdn.exe
  C:\Windows\System\eGKivdn.exe
  2⤵
  PID:444
- C:\Windows\System\ozybdth.exe
  C:\Windows\System\ozybdth.exe
  2⤵
  PID:3824
- C:\Windows\System\merNrmH.exe
  C:\Windows\System\merNrmH.exe
  2⤵
  PID:1724
- C:\Windows\System\DlveThn.exe
  C:\Windows\System\DlveThn.exe
  2⤵
  PID:1980
- C:\Windows\System\eZgkjky.exe
  C:\Windows\System\eZgkjky.exe
  2⤵
  PID:1004
- C:\Windows\System\xNyEGMX.exe
  C:\Windows\System\xNyEGMX.exe
  2⤵
  PID:4108
- C:\Windows\System\ekrWSsr.exe
  C:\Windows\System\ekrWSsr.exe
  2⤵
  PID:4124
- C:\Windows\System\fhOWXwU.exe
  C:\Windows\System\fhOWXwU.exe
  2⤵
  PID:4140
- C:\Windows\System\OPJjFUE.exe
  C:\Windows\System\OPJjFUE.exe
  2⤵
  PID:4156
- C:\Windows\System\zpDfOpA.exe
  C:\Windows\System\zpDfOpA.exe
  2⤵
  PID:4172
- C:\Windows\System\NhqxRCw.exe
  C:\Windows\System\NhqxRCw.exe
  2⤵
  PID:4192
- C:\Windows\System\DDrQgSW.exe
  C:\Windows\System\DDrQgSW.exe
  2⤵
  PID:4208
- C:\Windows\System\RXfAorX.exe
  C:\Windows\System\RXfAorX.exe
  2⤵
  PID:4224
- C:\Windows\System\aKfpRgI.exe
  C:\Windows\System\aKfpRgI.exe
  2⤵
  PID:4240
- C:\Windows\System\hhGYiye.exe
  C:\Windows\System\hhGYiye.exe
  2⤵
  PID:4256
- C:\Windows\System\MPTYYPd.exe
  C:\Windows\System\MPTYYPd.exe
  2⤵
  PID:4272
- C:\Windows\System\uarIsty.exe
  C:\Windows\System\uarIsty.exe
  2⤵
  PID:4292
- C:\Windows\System\zuGKnTz.exe
  C:\Windows\System\zuGKnTz.exe
  2⤵
  PID:4308
- C:\Windows\System\WmfrMVD.exe
  C:\Windows\System\WmfrMVD.exe
  2⤵
  PID:4324
- C:\Windows\System\KKJoHAW.exe
  C:\Windows\System\KKJoHAW.exe
  2⤵
  PID:4532
- C:\Windows\System\LzINYhs.exe
  C:\Windows\System\LzINYhs.exe
  2⤵
  PID:4548
- C:\Windows\System\qaGSETg.exe
  C:\Windows\System\qaGSETg.exe
  2⤵
  PID:4568
- C:\Windows\System\tgTHtDy.exe
  C:\Windows\System\tgTHtDy.exe
  2⤵
  PID:4584
- C:\Windows\System\AKOBFAP.exe
  C:\Windows\System\AKOBFAP.exe
  2⤵
  PID:4600
- C:\Windows\System\CMnlPBA.exe
  C:\Windows\System\CMnlPBA.exe
  2⤵
  PID:4620
- C:\Windows\System\HHkHzZX.exe
  C:\Windows\System\HHkHzZX.exe
  2⤵
  PID:4636
- C:\Windows\System\fjNnufO.exe
  C:\Windows\System\fjNnufO.exe
  2⤵
  PID:4652
- C:\Windows\System\jNnXadh.exe
  C:\Windows\System\jNnXadh.exe
  2⤵
  PID:4676
- C:\Windows\System\GTPvTHC.exe
  C:\Windows\System\GTPvTHC.exe
  2⤵
  PID:4744
- C:\Windows\System\gDpmGOR.exe
  C:\Windows\System\gDpmGOR.exe
  2⤵
  PID:4760
- C:\Windows\System\qyPNjTP.exe
  C:\Windows\System\qyPNjTP.exe
  2⤵
  PID:4776
- C:\Windows\System\txNgVgx.exe
  C:\Windows\System\txNgVgx.exe
  2⤵
  PID:4792
- C:\Windows\System\pXoTQzm.exe
  C:\Windows\System\pXoTQzm.exe
  2⤵
  PID:4808
- C:\Windows\System\PRpuwqM.exe
  C:\Windows\System\PRpuwqM.exe
  2⤵
  PID:4824
- C:\Windows\System\PlGapAF.exe
  C:\Windows\System\PlGapAF.exe
  2⤵
  PID:4840
- C:\Windows\System\twTRTks.exe
  C:\Windows\System\twTRTks.exe
  2⤵
  PID:4860
- C:\Windows\System\zjLydWZ.exe
  C:\Windows\System\zjLydWZ.exe
  2⤵
  PID:4888
- C:\Windows\System\dPjzSLM.exe
  C:\Windows\System\dPjzSLM.exe
  2⤵
  PID:4904
- C:\Windows\System\rbPkNen.exe
  C:\Windows\System\rbPkNen.exe
  2⤵
  PID:4928
- C:\Windows\System\xYzXWri.exe
  C:\Windows\System\xYzXWri.exe
  2⤵
  PID:4944
- C:\Windows\System\XFNuUms.exe
  C:\Windows\System\XFNuUms.exe
  2⤵
  PID:4960
- C:\Windows\System\DeSfnCt.exe
  C:\Windows\System\DeSfnCt.exe
  2⤵
  PID:4980
- C:\Windows\System\LRhJhuN.exe
  C:\Windows\System\LRhJhuN.exe
  2⤵
  PID:4996
- C:\Windows\System\fGsIePA.exe
  C:\Windows\System\fGsIePA.exe
  2⤵
  PID:5012
- C:\Windows\System\nTiMszI.exe
  C:\Windows\System\nTiMszI.exe
  2⤵
  PID:5028
- C:\Windows\System\mDVwcnr.exe
  C:\Windows\System\mDVwcnr.exe
  2⤵
  PID:5048
- C:\Windows\System\okURHvK.exe
  C:\Windows\System\okURHvK.exe
  2⤵
  PID:5064
- C:\Windows\System\bCoYGPq.exe
  C:\Windows\System\bCoYGPq.exe
  2⤵
  PID:536
- C:\Windows\System\GgBOsuw.exe
  C:\Windows\System\GgBOsuw.exe
  2⤵
  PID:2852
- C:\Windows\System\odbtqLM.exe
  C:\Windows\System\odbtqLM.exe
  2⤵
  PID:3484
- C:\Windows\System\mKPnnpl.exe
  C:\Windows\System\mKPnnpl.exe
  2⤵
  PID:2436
- C:\Windows\System\MYTpEHF.exe
  C:\Windows\System\MYTpEHF.exe
  2⤵
  PID:3372
- C:\Windows\System\UwdMKLB.exe
  C:\Windows\System\UwdMKLB.exe
  2⤵
  PID:2580
- C:\Windows\System\itSiDwg.exe
  C:\Windows\System\itSiDwg.exe
  2⤵
  PID:2180
- C:\Windows\System\aLmSPPt.exe
  C:\Windows\System\aLmSPPt.exe
  2⤵
  PID:3700
- C:\Windows\System\MldIEEP.exe
  C:\Windows\System\MldIEEP.exe
  2⤵
  PID:3636
- C:\Windows\System\uAkaHKC.exe
  C:\Windows\System\uAkaHKC.exe
  2⤵
  PID:3004
- C:\Windows\System\vdIrOhk.exe
  C:\Windows\System\vdIrOhk.exe
  2⤵
  PID:1616
- C:\Windows\System\VMCaZkM.exe
  C:\Windows\System\VMCaZkM.exe
  2⤵
  PID:3836
- C:\Windows\System\cqrUzWn.exe
  C:\Windows\System\cqrUzWn.exe
  2⤵
  PID:4120
- C:\Windows\System\CElGcPC.exe
  C:\Windows\System\CElGcPC.exe
  2⤵
  PID:3308
- C:\Windows\System\gTGsYdj.exe
  C:\Windows\System\gTGsYdj.exe
  2⤵
  PID:4220
- C:\Windows\System\VDgdOEd.exe
  C:\Windows\System\VDgdOEd.exe
  2⤵
  PID:4188
- C:\Windows\System\NtRbaeo.exe
  C:\Windows\System\NtRbaeo.exe
  2⤵
  PID:3572
- C:\Windows\System\PsnwNkJ.exe
  C:\Windows\System\PsnwNkJ.exe
  2⤵
  PID:1612
- C:\Windows\System\uhtxnRE.exe
  C:\Windows\System\uhtxnRE.exe
  2⤵
  PID:4104
- C:\Windows\System\itxFWGD.exe
  C:\Windows\System\itxFWGD.exe
  2⤵
  PID:4200
- C:\Windows\System\tfuXdJQ.exe
  C:\Windows\System\tfuXdJQ.exe
  2⤵
  PID:4236
- C:\Windows\System\DwgcXqe.exe
  C:\Windows\System\DwgcXqe.exe
  2⤵
  PID:4304
- C:\Windows\System\SUNNQKz.exe
  C:\Windows\System\SUNNQKz.exe
  2⤵
  PID:4344
- C:\Windows\System\mdjSDbE.exe
  C:\Windows\System\mdjSDbE.exe
  2⤵
  PID:4364
- C:\Windows\System\VZzXcuk.exe
  C:\Windows\System\VZzXcuk.exe
  2⤵
  PID:4380
- C:\Windows\System\YoZyyTg.exe
  C:\Windows\System\YoZyyTg.exe
  2⤵
  PID:4396
- C:\Windows\System\XCiUNxE.exe
  C:\Windows\System\XCiUNxE.exe
  2⤵
  PID:4412
- C:\Windows\System\VNrqvYA.exe
  C:\Windows\System\VNrqvYA.exe
  2⤵
  PID:4436
- C:\Windows\System\lvAKwhQ.exe
  C:\Windows\System\lvAKwhQ.exe
  2⤵
  PID:4480
- C:\Windows\System\STHsvSr.exe
  C:\Windows\System\STHsvSr.exe
  2⤵
  PID:3672
- C:\Windows\System\fjfKFIp.exe
  C:\Windows\System\fjfKFIp.exe
  2⤵
  PID:4216
- C:\Windows\System\lOKeGmx.exe
  C:\Windows\System\lOKeGmx.exe
  2⤵
  PID:2780
- C:\Windows\System\ICwkGVx.exe
  C:\Windows\System\ICwkGVx.exe
  2⤵
  PID:4496
- C:\Windows\System\jRtnOLl.exe
  C:\Windows\System\jRtnOLl.exe
  2⤵
  PID:4540
- C:\Windows\System\ZoWpOFM.exe
  C:\Windows\System\ZoWpOFM.exe
  2⤵
  PID:4564
- C:\Windows\System\mWDfgPp.exe
  C:\Windows\System\mWDfgPp.exe
  2⤵
  PID:4576
- C:\Windows\System\JCOsVZq.exe
  C:\Windows\System\JCOsVZq.exe
  2⤵
  PID:4672
- C:\Windows\System\oDqZOSL.exe
  C:\Windows\System\oDqZOSL.exe
  2⤵
  PID:4644
- C:\Windows\System\ldVGcnA.exe
  C:\Windows\System\ldVGcnA.exe
  2⤵
  PID:4648
- C:\Windows\System\bYifhEe.exe
  C:\Windows\System\bYifhEe.exe
  2⤵
  PID:4704
- C:\Windows\System\fbRPwFt.exe
  C:\Windows\System\fbRPwFt.exe
  2⤵
  PID:4720
- C:\Windows\System\Bbkbulv.exe
  C:\Windows\System\Bbkbulv.exe
  2⤵
  PID:4752
- C:\Windows\System\cwGtHha.exe
  C:\Windows\System\cwGtHha.exe
  2⤵
  PID:4788
- C:\Windows\System\nTfEFLr.exe
  C:\Windows\System\nTfEFLr.exe
  2⤵
  PID:4852
- C:\Windows\System\xPMaaol.exe
  C:\Windows\System\xPMaaol.exe
  2⤵
  PID:4804
- C:\Windows\System\yYvZAnD.exe
  C:\Windows\System\yYvZAnD.exe
  2⤵
  PID:4848
- C:\Windows\System\cwBLJUX.exe
  C:\Windows\System\cwBLJUX.exe
  2⤵
  PID:4920
- C:\Windows\System\TcCpMYU.exe
  C:\Windows\System\TcCpMYU.exe
  2⤵
  PID:4972
- C:\Windows\System\tzYUjgr.exe
  C:\Windows\System\tzYUjgr.exe
  2⤵
  PID:4900
- C:\Windows\System\bVptgbk.exe
  C:\Windows\System\bVptgbk.exe
  2⤵
  PID:5004
- C:\Windows\System\zoFSONh.exe
  C:\Windows\System\zoFSONh.exe
  2⤵
  PID:4956
- C:\Windows\System\WnnltcY.exe
  C:\Windows\System\WnnltcY.exe
  2⤵
  PID:5040
- C:\Windows\System\yAElQAr.exe
  C:\Windows\System\yAElQAr.exe
  2⤵
  PID:5076
- C:\Windows\System\zJqBBYd.exe
  C:\Windows\System\zJqBBYd.exe
  2⤵
  PID:3340
- C:\Windows\System\MnmxHud.exe
  C:\Windows\System\MnmxHud.exe
  2⤵
  PID:3736
- C:\Windows\System\scHwlWh.exe
  C:\Windows\System\scHwlWh.exe
  2⤵
  PID:1688
- C:\Windows\System\sPmQlRd.exe
  C:\Windows\System\sPmQlRd.exe
  2⤵
  PID:2060
- C:\Windows\System\pAmTyQP.exe
  C:\Windows\System\pAmTyQP.exe
  2⤵
  PID:1144
- C:\Windows\System\XmIgrat.exe
  C:\Windows\System\XmIgrat.exe
  2⤵
  PID:1496
- C:\Windows\System\ZmfEiGO.exe
  C:\Windows\System\ZmfEiGO.exe
  2⤵
  PID:3860
- C:\Windows\System\TWZuEwH.exe
  C:\Windows\System\TWZuEwH.exe
  2⤵
  PID:4268
- C:\Windows\System\XvLpjhW.exe
  C:\Windows\System\XvLpjhW.exe
  2⤵
  PID:4432
- C:\Windows\System\uKrXEXb.exe
  C:\Windows\System\uKrXEXb.exe
  2⤵
  PID:4356
- C:\Windows\System\wPrizyf.exe
  C:\Windows\System\wPrizyf.exe
  2⤵
  PID:4360
- C:\Windows\System\CGeBgSk.exe
  C:\Windows\System\CGeBgSk.exe
  2⤵
  PID:4408
- C:\Windows\System\kLHlxJE.exe
  C:\Windows\System\kLHlxJE.exe
  2⤵
  PID:4452
- C:\Windows\System\kYUZgDb.exe
  C:\Windows\System\kYUZgDb.exe
  2⤵
  PID:4472
- C:\Windows\System\OBNzlov.exe
  C:\Windows\System\OBNzlov.exe
  2⤵
  PID:5084
- C:\Windows\System\BKirCbf.exe
  C:\Windows\System\BKirCbf.exe
  2⤵
  PID:4484
- C:\Windows\System\OPDAoIA.exe
  C:\Windows\System\OPDAoIA.exe
  2⤵
  PID:2656
- C:\Windows\System\qMQHVkp.exe
  C:\Windows\System\qMQHVkp.exe
  2⤵
  PID:4500
- C:\Windows\System\xzwqFFK.exe
  C:\Windows\System\xzwqFFK.exe
  2⤵
  PID:4504
- C:\Windows\System\LFjCZxp.exe
  C:\Windows\System\LFjCZxp.exe
  2⤵
  PID:4516
- C:\Windows\System\RtTyulb.exe
  C:\Windows\System\RtTyulb.exe
  2⤵
  PID:2456
- C:\Windows\System\cpAYnpP.exe
  C:\Windows\System\cpAYnpP.exe
  2⤵
  PID:4608
- C:\Windows\System\kFpJTjz.exe
  C:\Windows\System\kFpJTjz.exe
  2⤵
  PID:4716
- C:\Windows\System\YDJMRmD.exe
  C:\Windows\System\YDJMRmD.exe
  2⤵
  PID:4684
- C:\Windows\System\YSpCNsQ.exe
  C:\Windows\System\YSpCNsQ.exe
  2⤵
  PID:4768
- C:\Windows\System\TFAfnHo.exe
  C:\Windows\System\TFAfnHo.exe
  2⤵
  PID:4816
- C:\Windows\System\BfgsjUo.exe
  C:\Windows\System\BfgsjUo.exe
  2⤵
  PID:5104
- C:\Windows\System\QkYkwQw.exe
  C:\Windows\System\QkYkwQw.exe
  2⤵
  PID:4992
- C:\Windows\System\GCXDfxE.exe
  C:\Windows\System\GCXDfxE.exe
  2⤵
  PID:4988
- C:\Windows\System\ExBDkOn.exe
  C:\Windows\System\ExBDkOn.exe
  2⤵
  PID:4884
- C:\Windows\System\xSYIMqq.exe
  C:\Windows\System\xSYIMqq.exe
  2⤵
  PID:5044
- C:\Windows\System\RhtKSPy.exe
  C:\Windows\System\RhtKSPy.exe
  2⤵
  PID:2484
- C:\Windows\System\MuirtQK.exe
  C:\Windows\System\MuirtQK.exe
  2⤵
  PID:592
- C:\Windows\System\WwRzzim.exe
  C:\Windows\System\WwRzzim.exe
  2⤵
  PID:2568
- C:\Windows\System\BWffyAL.exe
  C:\Windows\System\BWffyAL.exe
  2⤵
  PID:4476
- C:\Windows\System\cnNDBYO.exe
  C:\Windows\System\cnNDBYO.exe
  2⤵
  PID:4204
- C:\Windows\System\FhDuVdG.exe
  C:\Windows\System\FhDuVdG.exe
  2⤵
  PID:3620
- C:\Windows\System\jtLsBuQ.exe
  C:\Windows\System\jtLsBuQ.exe
  2⤵
  PID:3536
- C:\Windows\System\qMJXnLn.exe
  C:\Windows\System\qMJXnLn.exe
  2⤵
  PID:4592
- C:\Windows\System\uAEFpDo.exe
  C:\Windows\System\uAEFpDo.exe
  2⤵
  PID:5072
- C:\Windows\System\twFLdar.exe
  C:\Windows\System\twFLdar.exe
  2⤵
  PID:4388
- C:\Windows\System\HkuHdmM.exe
  C:\Windows\System\HkuHdmM.exe
  2⤵
  PID:2280
- C:\Windows\System\AePRHwR.exe
  C:\Windows\System\AePRHwR.exe
  2⤵
  PID:4508
- C:\Windows\System\JHLDzrZ.exe
  C:\Windows\System\JHLDzrZ.exe
  2⤵
  PID:4712
- C:\Windows\System\agHvxgK.exe
  C:\Windows\System\agHvxgK.exe
  2⤵
  PID:4820
- C:\Windows\System\MsEWggl.exe
  C:\Windows\System\MsEWggl.exe
  2⤵
  PID:5112
- C:\Windows\System\PTRnTOz.exe
  C:\Windows\System\PTRnTOz.exe
  2⤵
  PID:3548
- C:\Windows\System\abPFcAT.exe
  C:\Windows\System\abPFcAT.exe
  2⤵
  PID:584
- C:\Windows\System\itLVhPm.exe
  C:\Windows\System\itLVhPm.exe
  2⤵
  PID:4152
- C:\Windows\System\CTzgFEC.exe
  C:\Windows\System\CTzgFEC.exe
  2⤵
  PID:2400
- C:\Windows\System\voFfSvF.exe
  C:\Windows\System\voFfSvF.exe
  2⤵
  PID:2236
- C:\Windows\System\cGiImfP.exe
  C:\Windows\System\cGiImfP.exe
  2⤵
  PID:4420
- C:\Windows\System\macpdXb.exe
  C:\Windows\System\macpdXb.exe
  2⤵
  PID:4464
- C:\Windows\System\pIqyCgA.exe
  C:\Windows\System\pIqyCgA.exe
  2⤵
  PID:2276
- C:\Windows\System\AhTAKoU.exe
  C:\Windows\System\AhTAKoU.exe
  2⤵
  PID:4248
- C:\Windows\System\JQBSjOi.exe
  C:\Windows\System\JQBSjOi.exe
  2⤵
  PID:4448
- C:\Windows\System\yXwVZOP.exe
  C:\Windows\System\yXwVZOP.exe
  2⤵
  PID:1992
- C:\Windows\System\acohZpW.exe
  C:\Windows\System\acohZpW.exe
  2⤵
  PID:4896
- C:\Windows\System\WLEXqnG.exe
  C:\Windows\System\WLEXqnG.exe
  2⤵
  PID:2596
- C:\Windows\System\aQgfVMB.exe
  C:\Windows\System\aQgfVMB.exe
  2⤵
  PID:4616
- C:\Windows\System\cHxApdt.exe
  C:\Windows\System\cHxApdt.exe
  2⤵
  PID:4580
- C:\Windows\System\MVGKqgC.exe
  C:\Windows\System\MVGKqgC.exe
  2⤵
  PID:5092
- C:\Windows\System\KnAsgPf.exe
  C:\Windows\System\KnAsgPf.exe
  2⤵
  PID:3260
- C:\Windows\System\GdZyGNU.exe
  C:\Windows\System\GdZyGNU.exe
  2⤵
  PID:4184
- C:\Windows\System\xWXEJSp.exe
  C:\Windows\System\xWXEJSp.exe
  2⤵
  PID:5128
- C:\Windows\System\tOtQomM.exe
  C:\Windows\System\tOtQomM.exe
  2⤵
  PID:5144
- C:\Windows\System\cljiOgt.exe
  C:\Windows\System\cljiOgt.exe
  2⤵
  PID:5164
- C:\Windows\System\PxzUnXY.exe
  C:\Windows\System\PxzUnXY.exe
  2⤵
  PID:5180
- C:\Windows\System\NHOuYRn.exe
  C:\Windows\System\NHOuYRn.exe
  2⤵
  PID:5196
- C:\Windows\System\bgIgRzM.exe
  C:\Windows\System\bgIgRzM.exe
  2⤵
  PID:5212
- C:\Windows\System\UuqTCnn.exe
  C:\Windows\System\UuqTCnn.exe
  2⤵
  PID:5228
- C:\Windows\System\SrxiTDY.exe
  C:\Windows\System\SrxiTDY.exe
  2⤵
  PID:5244
- C:\Windows\System\XOqiUiU.exe
  C:\Windows\System\XOqiUiU.exe
  2⤵
  PID:5260
- C:\Windows\System\FMQrkoY.exe
  C:\Windows\System\FMQrkoY.exe
  2⤵
  PID:5276
- C:\Windows\System\CRRgILi.exe
  C:\Windows\System\CRRgILi.exe
  2⤵
  PID:5292
- C:\Windows\System\BYeanyV.exe
  C:\Windows\System\BYeanyV.exe
  2⤵
  PID:5308
- C:\Windows\System\ZiceiPO.exe
  C:\Windows\System\ZiceiPO.exe
  2⤵
  PID:5324
- C:\Windows\System\ddTsdoG.exe
  C:\Windows\System\ddTsdoG.exe
  2⤵
  PID:5340
- C:\Windows\System\klWjKHV.exe
  C:\Windows\System\klWjKHV.exe
  2⤵
  PID:5356
- C:\Windows\System\OAJfRpT.exe
  C:\Windows\System\OAJfRpT.exe
  2⤵
  PID:5372
- C:\Windows\System\VAqfZqr.exe
  C:\Windows\System\VAqfZqr.exe
  2⤵
  PID:5388
- C:\Windows\System\tyCtsur.exe
  C:\Windows\System\tyCtsur.exe
  2⤵
  PID:5404
- C:\Windows\System\OnvTAZh.exe
  C:\Windows\System\OnvTAZh.exe
  2⤵
  PID:5420
- C:\Windows\System\YbjHoyj.exe
  C:\Windows\System\YbjHoyj.exe
  2⤵
  PID:5436
- C:\Windows\System\WGJrSOX.exe
  C:\Windows\System\WGJrSOX.exe
  2⤵
  PID:5452
- C:\Windows\System\RfLtXcp.exe
  C:\Windows\System\RfLtXcp.exe
  2⤵
  PID:5468
- C:\Windows\System\bceLwVW.exe
  C:\Windows\System\bceLwVW.exe
  2⤵
  PID:5484
- C:\Windows\System\WdqRgUp.exe
  C:\Windows\System\WdqRgUp.exe
  2⤵
  PID:5500
- C:\Windows\System\zinkMuG.exe
  C:\Windows\System\zinkMuG.exe
  2⤵
  PID:5520
- C:\Windows\System\VYhUDPG.exe
  C:\Windows\System\VYhUDPG.exe
  2⤵
  PID:5536
- C:\Windows\System\DQkkiRl.exe
  C:\Windows\System\DQkkiRl.exe
  2⤵
  PID:5552
- C:\Windows\System\bSRYFOD.exe
  C:\Windows\System\bSRYFOD.exe
  2⤵
  PID:5568
- C:\Windows\System\QkryGkx.exe
  C:\Windows\System\QkryGkx.exe
  2⤵
  PID:5584
- C:\Windows\System\vssLwPt.exe
  C:\Windows\System\vssLwPt.exe
  2⤵
  PID:5600
- C:\Windows\System\eplqMNh.exe
  C:\Windows\System\eplqMNh.exe
  2⤵
  PID:5616
- C:\Windows\System\gnTZBQK.exe
  C:\Windows\System\gnTZBQK.exe
  2⤵
  PID:5632
- C:\Windows\System\JxGhFqC.exe
  C:\Windows\System\JxGhFqC.exe
  2⤵
  PID:5648
- C:\Windows\System\BzbbKIe.exe
  C:\Windows\System\BzbbKIe.exe
  2⤵
  PID:5664
- C:\Windows\System\qvKydvU.exe
  C:\Windows\System\qvKydvU.exe
  2⤵
  PID:5688
- C:\Windows\System\kgVPInV.exe
  C:\Windows\System\kgVPInV.exe
  2⤵
  PID:5704
- C:\Windows\System\dqOzklS.exe
  C:\Windows\System\dqOzklS.exe
  2⤵
  PID:5720
- C:\Windows\System\oeyTRDn.exe
  C:\Windows\System\oeyTRDn.exe
  2⤵
  PID:5736
- C:\Windows\System\fNyfXKF.exe
  C:\Windows\System\fNyfXKF.exe
  2⤵
  PID:5752
- C:\Windows\System\aQkJmTS.exe
  C:\Windows\System\aQkJmTS.exe
  2⤵
  PID:5768
- C:\Windows\System\TIotBtf.exe
  C:\Windows\System\TIotBtf.exe
  2⤵
  PID:5784
- C:\Windows\System\lcNumLA.exe
  C:\Windows\System\lcNumLA.exe
  2⤵
  PID:5800
- C:\Windows\System\lbvCIIm.exe
  C:\Windows\System\lbvCIIm.exe
  2⤵
  PID:5820
- C:\Windows\System\LqTZiVU.exe
  C:\Windows\System\LqTZiVU.exe
  2⤵
  PID:5836
- C:\Windows\System\MfUwQnA.exe
  C:\Windows\System\MfUwQnA.exe
  2⤵
  PID:5864
- C:\Windows\System\rusCorh.exe
  C:\Windows\System\rusCorh.exe
  2⤵
  PID:5880
- C:\Windows\System\sHMadxx.exe
  C:\Windows\System\sHMadxx.exe
  2⤵
  PID:5896
- C:\Windows\System\iHMbPlB.exe
  C:\Windows\System\iHMbPlB.exe
  2⤵
  PID:5912
- C:\Windows\System\VttwEIw.exe
  C:\Windows\System\VttwEIw.exe
  2⤵
  PID:5928
- C:\Windows\System\vaoqPzd.exe
  C:\Windows\System\vaoqPzd.exe
  2⤵
  PID:5944
- C:\Windows\System\qkbNfbF.exe
  C:\Windows\System\qkbNfbF.exe
  2⤵
  PID:5960
- C:\Windows\System\EjtJDMM.exe
  C:\Windows\System\EjtJDMM.exe
  2⤵
  PID:5976
- C:\Windows\System\nmFMRfx.exe
  C:\Windows\System\nmFMRfx.exe
  2⤵
  PID:5996
- C:\Windows\System\rBvCXEW.exe
  C:\Windows\System\rBvCXEW.exe
  2⤵
  PID:6012
- C:\Windows\System\lZNcSIR.exe
  C:\Windows\System\lZNcSIR.exe
  2⤵
  PID:6028
- C:\Windows\System\hmaYkNR.exe
  C:\Windows\System\hmaYkNR.exe
  2⤵
  PID:6044
- C:\Windows\System\vcHFQOm.exe
  C:\Windows\System\vcHFQOm.exe
  2⤵
  PID:6060
- C:\Windows\System\HVrAdMn.exe
  C:\Windows\System\HVrAdMn.exe
  2⤵
  PID:6076
- C:\Windows\System\QOyihYa.exe
  C:\Windows\System\QOyihYa.exe
  2⤵
  PID:6092
- C:\Windows\System\oeWQocG.exe
  C:\Windows\System\oeWQocG.exe
  2⤵
  PID:6108
- C:\Windows\System\ndthnBq.exe
  C:\Windows\System\ndthnBq.exe
  2⤵
  PID:6124
- C:\Windows\System\NlRkBfi.exe
  C:\Windows\System\NlRkBfi.exe
  2⤵
  PID:6140
- C:\Windows\System\XxENGHq.exe
  C:\Windows\System\XxENGHq.exe
  2⤵
  PID:4488
- C:\Windows\System\MZVIVtT.exe
  C:\Windows\System\MZVIVtT.exe
  2⤵
  PID:4784
- C:\Windows\System\OJyJnwE.exe
  C:\Windows\System\OJyJnwE.exe
  2⤵
  PID:3392
- C:\Windows\System\ZuzQxVx.exe
  C:\Windows\System\ZuzQxVx.exe
  2⤵
  PID:5220
- C:\Windows\System\HqWtjlu.exe
  C:\Windows\System\HqWtjlu.exe
  2⤵
  PID:5272
- C:\Windows\System\LAaTHOW.exe
  C:\Windows\System\LAaTHOW.exe
  2⤵
  PID:5336
- C:\Windows\System\kDCCngO.exe
  C:\Windows\System\kDCCngO.exe
  2⤵
  PID:5396
- C:\Windows\System\tAxraYP.exe
  C:\Windows\System\tAxraYP.exe
  2⤵
  PID:5432
- C:\Windows\System\QQPspvv.exe
  C:\Windows\System\QQPspvv.exe
  2⤵
  PID:5492
- C:\Windows\System\GjEumYq.exe
  C:\Windows\System\GjEumYq.exe
  2⤵
  PID:5560
- C:\Windows\System\JjuBbAh.exe
  C:\Windows\System\JjuBbAh.exe
  2⤵
  PID:5596
- C:\Windows\System\mnNNmHQ.exe
  C:\Windows\System\mnNNmHQ.exe
  2⤵
  PID:5660
- C:\Windows\System\OAnXyfm.exe
  C:\Windows\System\OAnXyfm.exe
  2⤵
  PID:5316
- C:\Windows\System\dUDtePi.exe
  C:\Windows\System\dUDtePi.exe
  2⤵
  PID:4300
- C:\Windows\System\kFFYLDV.exe
  C:\Windows\System\kFFYLDV.exe
  2⤵
  PID:5056
- C:\Windows\System\SgsikKk.exe
  C:\Windows\System\SgsikKk.exe
  2⤵
  PID:5856
- C:\Windows\System\SYgtpKf.exe
  C:\Windows\System\SYgtpKf.exe
  2⤵
  PID:5816
- C:\Windows\System\BzLXFZM.exe
  C:\Windows\System\BzLXFZM.exe
  2⤵
  PID:5872
- C:\Windows\System\MkXKpTd.exe
  C:\Windows\System\MkXKpTd.exe
  2⤵
  PID:5892
- C:\Windows\System\TNrkAbE.exe
  C:\Windows\System\TNrkAbE.exe
  2⤵
  PID:5920
- C:\Windows\System\ijlxbDm.exe
  C:\Windows\System\ijlxbDm.exe
  2⤵
  PID:5956
- C:\Windows\System\JHEqasQ.exe
  C:\Windows\System\JHEqasQ.exe
  2⤵
  PID:5936
- C:\Windows\System\ZYTJvtv.exe
  C:\Windows\System\ZYTJvtv.exe
  2⤵
  PID:5992
- C:\Windows\System\scCxycX.exe
  C:\Windows\System\scCxycX.exe
  2⤵
  PID:6084
- C:\Windows\System\bdRcLYw.exe
  C:\Windows\System\bdRcLYw.exe
  2⤵
  PID:1252
- C:\Windows\System\qPiLshx.exe
  C:\Windows\System\qPiLshx.exe
  2⤵
  PID:6104
- C:\Windows\System\agvdHTL.exe
  C:\Windows\System\agvdHTL.exe
  2⤵
  PID:6040
- C:\Windows\System\FXNVDNd.exe
  C:\Windows\System\FXNVDNd.exe
  2⤵
  PID:2996
- C:\Windows\System\ZFAZMZE.exe
  C:\Windows\System\ZFAZMZE.exe
  2⤵
  PID:5156
- C:\Windows\System\PdgAIsO.exe
  C:\Windows\System\PdgAIsO.exe
  2⤵
  PID:5364
- C:\Windows\System\ZyvzSBM.exe
  C:\Windows\System\ZyvzSBM.exe
  2⤵
  PID:5592
- C:\Windows\System\PQrXCsj.exe
  C:\Windows\System\PQrXCsj.exe
  2⤵
  PID:5628
- C:\Windows\System\jKrvTBn.exe
  C:\Windows\System\jKrvTBn.exe
  2⤵
  PID:5656
- C:\Windows\System\eWWisbE.exe
  C:\Windows\System\eWWisbE.exe
  2⤵
  PID:5732
- C:\Windows\System\ovzudVV.exe
  C:\Windows\System\ovzudVV.exe
  2⤵
  PID:4100
- C:\Windows\System\qTKTWIb.exe
  C:\Windows\System\qTKTWIb.exe
  2⤵
  PID:5140
- C:\Windows\System\molVtJi.exe
  C:\Windows\System\molVtJi.exe
  2⤵
  PID:5204
- C:\Windows\System\YybpORH.exe
  C:\Windows\System\YybpORH.exe
  2⤵
  PID:5676
- C:\Windows\System\vskxTuT.exe
  C:\Windows\System\vskxTuT.exe
  2⤵
  PID:5672
- C:\Windows\System\tBSiDzi.exe
  C:\Windows\System\tBSiDzi.exe
  2⤵
  PID:5612
- C:\Windows\System\tUEaVAs.exe
  C:\Windows\System\tUEaVAs.exe
  2⤵
  PID:5548
- C:\Windows\System\IhnKARd.exe
  C:\Windows\System\IhnKARd.exe
  2⤵
  PID:5508
- C:\Windows\System\fiSGMty.exe
  C:\Windows\System\fiSGMty.exe
  2⤵
  PID:5412
- C:\Windows\System\atbCoNG.exe
  C:\Windows\System\atbCoNG.exe
  2⤵
  PID:5352
- C:\Windows\System\pourirh.exe
  C:\Windows\System\pourirh.exe
  2⤵
  PID:5904
- C:\Windows\System\ZTFCcXn.exe
  C:\Windows\System\ZTFCcXn.exe
  2⤵
  PID:5924
- C:\Windows\System\gKcOgHk.exe
  C:\Windows\System\gKcOgHk.exe
  2⤵
  PID:5268
- C:\Windows\System\XqBOWvt.exe
  C:\Windows\System\XqBOWvt.exe
  2⤵
  PID:4772
- C:\Windows\System\zZJoKIj.exe
  C:\Windows\System\zZJoKIj.exe
  2⤵
  PID:4460
- C:\Windows\System\IzUmLMV.exe
  C:\Windows\System\IzUmLMV.exe
  2⤵
  PID:5680
- C:\Windows\System\VsIJteO.exe
  C:\Windows\System\VsIJteO.exe
  2⤵
  PID:5776
- C:\Windows\System\yMCGxdu.exe
  C:\Windows\System\yMCGxdu.exe
  2⤵
  PID:5984
- C:\Windows\System\jsdABqC.exe
  C:\Windows\System\jsdABqC.exe
  2⤵
  PID:5908
- C:\Windows\System\eqdUSVy.exe
  C:\Windows\System\eqdUSVy.exe
  2⤵
  PID:6072
- C:\Windows\System\atVBGpN.exe
  C:\Windows\System\atVBGpN.exe
  2⤵
  PID:5516
- C:\Windows\System\iJmhjAw.exe
  C:\Windows\System\iJmhjAw.exe
  2⤵
  PID:5252
- C:\Windows\System\DYMrotl.exe
  C:\Windows\System\DYMrotl.exe
  2⤵
  PID:5464
- C:\Windows\System\TEGiarR.exe
  C:\Windows\System\TEGiarR.exe
  2⤵
  PID:4700
- C:\Windows\System\JXkEZWx.exe
  C:\Windows\System\JXkEZWx.exe
  2⤵
  PID:5380
- C:\Windows\System\vWlkGVp.exe
  C:\Windows\System\vWlkGVp.exe
  2⤵
  PID:5176
- C:\Windows\System\lJnNQPX.exe
  C:\Windows\System\lJnNQPX.exe
  2⤵
  PID:5576
- C:\Windows\System\CzySvsj.exe
  C:\Windows\System\CzySvsj.exe
  2⤵
  PID:5844
- C:\Windows\System\ivpKxIK.exe
  C:\Windows\System\ivpKxIK.exe
  2⤵
  PID:5828
- C:\Windows\System\DaCxqXO.exe
  C:\Windows\System\DaCxqXO.exe
  2⤵
  PID:3192
- C:\Windows\System\RFpGaPw.exe
  C:\Windows\System\RFpGaPw.exe
  2⤵
  PID:5808
- C:\Windows\System\FdtzgCg.exe
  C:\Windows\System\FdtzgCg.exe
  2⤵
  PID:6160
- C:\Windows\System\pxxOzrP.exe
  C:\Windows\System\pxxOzrP.exe
  2⤵
  PID:6176
- C:\Windows\System\oiqlDOA.exe
  C:\Windows\System\oiqlDOA.exe
  2⤵
  PID:6192
- C:\Windows\System\cDZdlHl.exe
  C:\Windows\System\cDZdlHl.exe
  2⤵
  PID:6208
- C:\Windows\System\QuPFioM.exe
  C:\Windows\System\QuPFioM.exe
  2⤵
  PID:6224
- C:\Windows\System\OaGbDJF.exe
  C:\Windows\System\OaGbDJF.exe
  2⤵
  PID:6240
- C:\Windows\System\KiZVZRK.exe
  C:\Windows\System\KiZVZRK.exe
  2⤵
  PID:6256
- C:\Windows\System\kgmIGcD.exe
  C:\Windows\System\kgmIGcD.exe
  2⤵
  PID:6272
- C:\Windows\System\CEEImvu.exe
  C:\Windows\System\CEEImvu.exe
  2⤵
  PID:6288
- C:\Windows\System\fVAQOiy.exe
  C:\Windows\System\fVAQOiy.exe
  2⤵
  PID:6304
- C:\Windows\System\TWpDAlk.exe
  C:\Windows\System\TWpDAlk.exe
  2⤵
  PID:6320
- C:\Windows\System\RnVnkgk.exe
  C:\Windows\System\RnVnkgk.exe
  2⤵
  PID:6336
- C:\Windows\System\JmGAjvX.exe
  C:\Windows\System\JmGAjvX.exe
  2⤵
  PID:6352
- C:\Windows\System\pNGeStK.exe
  C:\Windows\System\pNGeStK.exe
  2⤵
  PID:6368
- C:\Windows\System\hFCvevp.exe
  C:\Windows\System\hFCvevp.exe
  2⤵
  PID:6384
- C:\Windows\System\cpEzvpU.exe
  C:\Windows\System\cpEzvpU.exe
  2⤵
  PID:6400
- C:\Windows\System\PRdlCjT.exe
  C:\Windows\System\PRdlCjT.exe
  2⤵
  PID:6416
- C:\Windows\System\sdpbfVr.exe
  C:\Windows\System\sdpbfVr.exe
  2⤵
  PID:6436
- C:\Windows\System\TUYkolV.exe
  C:\Windows\System\TUYkolV.exe
  2⤵
  PID:6452
- C:\Windows\System\trSdTTp.exe
  C:\Windows\System\trSdTTp.exe
  2⤵
  PID:6468
- C:\Windows\System\DtzZXpZ.exe
  C:\Windows\System\DtzZXpZ.exe
  2⤵
  PID:6484
- C:\Windows\System\wdRcILG.exe
  C:\Windows\System\wdRcILG.exe
  2⤵
  PID:6500
- C:\Windows\System\LzkLjAQ.exe
  C:\Windows\System\LzkLjAQ.exe
  2⤵
  PID:6516
- C:\Windows\System\LxxspvO.exe
  C:\Windows\System\LxxspvO.exe
  2⤵
  PID:6532
- C:\Windows\System\OkqmAcG.exe
  C:\Windows\System\OkqmAcG.exe
  2⤵
  PID:6548
- C:\Windows\System\fZcOQZE.exe
  C:\Windows\System\fZcOQZE.exe
  2⤵
  PID:6564
- C:\Windows\System\keecAtD.exe
  C:\Windows\System\keecAtD.exe
  2⤵
  PID:6580
- C:\Windows\System\AywTwjA.exe
  C:\Windows\System\AywTwjA.exe
  2⤵
  PID:6596
- C:\Windows\System\ELoyeil.exe
  C:\Windows\System\ELoyeil.exe
  2⤵
  PID:6612
- C:\Windows\System\hlrJbtI.exe
  C:\Windows\System\hlrJbtI.exe
  2⤵
  PID:6628
- C:\Windows\System\fDNufiF.exe
  C:\Windows\System\fDNufiF.exe
  2⤵
  PID:6644
- C:\Windows\System\AqbXQKN.exe
  C:\Windows\System\AqbXQKN.exe
  2⤵
  PID:6660
- C:\Windows\System\WczMzTj.exe
  C:\Windows\System\WczMzTj.exe
  2⤵
  PID:6676
- C:\Windows\System\zLyqPDH.exe
  C:\Windows\System\zLyqPDH.exe
  2⤵
  PID:6692
- C:\Windows\System\ijblOiK.exe
  C:\Windows\System\ijblOiK.exe
  2⤵
  PID:6776
- C:\Windows\System\IWYaFIS.exe
  C:\Windows\System\IWYaFIS.exe
  2⤵
  PID:6792
- C:\Windows\System\hbiPWgh.exe
  C:\Windows\System\hbiPWgh.exe
  2⤵
  PID:6808
- C:\Windows\System\YRWBrul.exe
  C:\Windows\System\YRWBrul.exe
  2⤵
  PID:6824
- C:\Windows\System\nWQjwoM.exe
  C:\Windows\System\nWQjwoM.exe
  2⤵
  PID:6840
- C:\Windows\System\YFXcJLV.exe
  C:\Windows\System\YFXcJLV.exe
  2⤵
  PID:6856
- C:\Windows\System\BqiRCeu.exe
  C:\Windows\System\BqiRCeu.exe
  2⤵
  PID:6876
- C:\Windows\System\jGsHNxt.exe
  C:\Windows\System\jGsHNxt.exe
  2⤵
  PID:6892
- C:\Windows\System\NvSnaai.exe
  C:\Windows\System\NvSnaai.exe
  2⤵
  PID:6908
- C:\Windows\System\jdSqZPm.exe
  C:\Windows\System\jdSqZPm.exe
  2⤵
  PID:6924
- C:\Windows\System\jWZTICu.exe
  C:\Windows\System\jWZTICu.exe
  2⤵
  PID:6940
- C:\Windows\System\XJJxwSq.exe
  C:\Windows\System\XJJxwSq.exe
  2⤵
  PID:6956
- C:\Windows\System\jYoZgCx.exe
  C:\Windows\System\jYoZgCx.exe
  2⤵
  PID:6972
- C:\Windows\System\edjdJXQ.exe
  C:\Windows\System\edjdJXQ.exe
  2⤵
  PID:6988
- C:\Windows\System\xQkOslD.exe
  C:\Windows\System\xQkOslD.exe
  2⤵
  PID:7004
- C:\Windows\System\FYdqwXD.exe
  C:\Windows\System\FYdqwXD.exe
  2⤵
  PID:7024
- C:\Windows\System\HDSffYt.exe
  C:\Windows\System\HDSffYt.exe
  2⤵
  PID:7040
- C:\Windows\System\ztOcLLN.exe
  C:\Windows\System\ztOcLLN.exe
  2⤵
  PID:7056
- C:\Windows\System\Evyuovu.exe
  C:\Windows\System\Evyuovu.exe
  2⤵
  PID:7072
- C:\Windows\System\fZYbLGy.exe
  C:\Windows\System\fZYbLGy.exe
  2⤵
  PID:7088
- C:\Windows\System\lWWXRoZ.exe
  C:\Windows\System\lWWXRoZ.exe
  2⤵
  PID:7104
- C:\Windows\System\GIRgqWg.exe
  C:\Windows\System\GIRgqWg.exe
  2⤵
  PID:7124
- C:\Windows\System\bVCeVDQ.exe
  C:\Windows\System\bVCeVDQ.exe
  2⤵
  PID:7140
- C:\Windows\System\XFOeROA.exe
  C:\Windows\System\XFOeROA.exe
  2⤵
  PID:7156
- C:\Windows\System\xrfxDQt.exe
  C:\Windows\System\xrfxDQt.exe
  2⤵
  PID:5716
- C:\Windows\System\YcBKYUz.exe
  C:\Windows\System\YcBKYUz.exe
  2⤵
  PID:5640
- C:\Windows\System\xmbWYxf.exe
  C:\Windows\System\xmbWYxf.exe
  2⤵
  PID:6052
- C:\Windows\System\mqMFnkT.exe
  C:\Windows\System\mqMFnkT.exe
  2⤵
  PID:4252
- C:\Windows\System\eKcSvGx.exe
  C:\Windows\System\eKcSvGx.exe
  2⤵
  PID:6172
- C:\Windows\System\TEImJsy.exe
  C:\Windows\System\TEImJsy.exe
  2⤵
  PID:6232
- C:\Windows\System\VGBcISm.exe
  C:\Windows\System\VGBcISm.exe
  2⤵
  PID:6296
- C:\Windows\System\kMDOPWG.exe
  C:\Windows\System\kMDOPWG.exe
  2⤵
  PID:6360
- C:\Windows\System\NivryuY.exe
  C:\Windows\System\NivryuY.exe
  2⤵
  PID:6428
- C:\Windows\System\jsTzAMi.exe
  C:\Windows\System\jsTzAMi.exe
  2⤵
  PID:6464
- C:\Windows\System\VetHEXW.exe
  C:\Windows\System\VetHEXW.exe
  2⤵
  PID:6280
- C:\Windows\System\eeWZYkn.exe
  C:\Windows\System\eeWZYkn.exe
  2⤵
  PID:6316
- C:\Windows\System\hGJajKE.exe
  C:\Windows\System\hGJajKE.exe
  2⤵
  PID:6556
- C:\Windows\System\xqyoeFz.exe
  C:\Windows\System\xqyoeFz.exe
  2⤵
  PID:6620
- C:\Windows\System\gVaXvlQ.exe
  C:\Windows\System\gVaXvlQ.exe
  2⤵
  PID:5416
- C:\Windows\System\JWvuvMD.exe
  C:\Windows\System\JWvuvMD.exe
  2⤵
  PID:6188
- C:\Windows\System\tuBvSMz.exe
  C:\Windows\System\tuBvSMz.exe
  2⤵
  PID:6252
- C:\Windows\System\DaicTcn.exe
  C:\Windows\System\DaicTcn.exe
  2⤵
  PID:6380
- C:\Windows\System\eqjmbjT.exe
  C:\Windows\System\eqjmbjT.exe
  2⤵
  PID:6448
- C:\Windows\System\OECGAFQ.exe
  C:\Windows\System\OECGAFQ.exe
  2⤵
  PID:5448
- C:\Windows\System\TUJDzMr.exe
  C:\Windows\System\TUJDzMr.exe
  2⤵
  PID:6576
- C:\Windows\System\DYRHrsd.exe
  C:\Windows\System\DYRHrsd.exe
  2⤵
  PID:6668
- C:\Windows\System\vszInfM.exe
  C:\Windows\System\vszInfM.exe
  2⤵
  PID:6684
- C:\Windows\System\QxFocyY.exe
  C:\Windows\System\QxFocyY.exe
  2⤵
  PID:6708
- C:\Windows\System\GzxSRWl.exe
  C:\Windows\System\GzxSRWl.exe
  2⤵
  PID:6724
- C:\Windows\System\uAglwpt.exe
  C:\Windows\System\uAglwpt.exe
  2⤵
  PID:6740
- C:\Windows\System\FlbLCrS.exe
  C:\Windows\System\FlbLCrS.exe
  2⤵
  PID:6760
- C:\Windows\System\hbftVOx.exe
  C:\Windows\System\hbftVOx.exe
  2⤵
  PID:6788
- C:\Windows\System\ijztLQi.exe
  C:\Windows\System\ijztLQi.exe
  2⤵
  PID:6800
- C:\Windows\System\UGKjOCs.exe
  C:\Windows\System\UGKjOCs.exe
  2⤵
  PID:6820
- C:\Windows\System\XqGGlJN.exe
  C:\Windows\System\XqGGlJN.exe
  2⤵
  PID:5684
- C:\Windows\System\TjfaHvF.exe
  C:\Windows\System\TjfaHvF.exe
  2⤵
  PID:6888
- C:\Windows\System\diigOXF.exe
  C:\Windows\System\diigOXF.exe
  2⤵
  PID:6980
- C:\Windows\System\XXXTYUm.exe
  C:\Windows\System\XXXTYUm.exe
  2⤵
  PID:7020
- C:\Windows\System\BvyEGMD.exe
  C:\Windows\System\BvyEGMD.exe
  2⤵
  PID:7052
- C:\Windows\System\PfaMoGO.exe
  C:\Windows\System\PfaMoGO.exe
  2⤵
  PID:7120
- C:\Windows\System\AAIIufC.exe
  C:\Windows\System\AAIIufC.exe
  2⤵
  PID:6132
- C:\Windows\System\XUpvUCn.exe
  C:\Windows\System\XUpvUCn.exe
  2⤵
  PID:5444
- C:\Windows\System\hXtTbuk.exe
  C:\Windows\System\hXtTbuk.exe
  2⤵
  PID:7036
- C:\Windows\System\qpWlrua.exe
  C:\Windows\System\qpWlrua.exe
  2⤵
  PID:6932
- C:\Windows\System\xPVkDeH.exe
  C:\Windows\System\xPVkDeH.exe
  2⤵
  PID:7064
- C:\Windows\System\VbSIyOL.exe
  C:\Windows\System\VbSIyOL.exe
  2⤵
  PID:7164
- C:\Windows\System\HujYtWH.exe
  C:\Windows\System\HujYtWH.exe
  2⤵
  PID:5136
- C:\Windows\System\wTjBUgO.exe
  C:\Windows\System\wTjBUgO.exe
  2⤵
  PID:6332
- C:\Windows\System\eFAEcee.exe
  C:\Windows\System\eFAEcee.exe
  2⤵
  PID:6344
- C:\Windows\System\HEslwSf.exe
  C:\Windows\System\HEslwSf.exe
  2⤵
  PID:5240
- C:\Windows\System\AHFAdco.exe
  C:\Windows\System\AHFAdco.exe
  2⤵
  PID:6376
- C:\Windows\System\EsFKxBw.exe
  C:\Windows\System\EsFKxBw.exe
  2⤵
  PID:6268
- C:\Windows\System\jATVpVP.exe
  C:\Windows\System\jATVpVP.exe
  2⤵
  PID:6528
- C:\Windows\System\QSpuoOY.exe
  C:\Windows\System\QSpuoOY.exe
  2⤵
  PID:6248
- C:\Windows\System\jzySTQA.exe
  C:\Windows\System\jzySTQA.exe
  2⤵
  PID:6572
- C:\Windows\System\FZFWNfR.exe
  C:\Windows\System\FZFWNfR.exe
  2⤵
  PID:6688
- C:\Windows\System\wEVTMZw.exe
  C:\Windows\System\wEVTMZw.exe
  2⤵
  PID:6784
- C:\Windows\System\lDItLfc.exe
  C:\Windows\System\lDItLfc.exe
  2⤵
  PID:6900
- C:\Windows\System\YlTniBi.exe
  C:\Windows\System\YlTniBi.exe
  2⤵
  PID:5428
- C:\Windows\System\ZjwzjFB.exe
  C:\Windows\System\ZjwzjFB.exe
  2⤵
  PID:7132
- C:\Windows\System\TCrNSWZ.exe
  C:\Windows\System\TCrNSWZ.exe
  2⤵
  PID:6592
- C:\Windows\System\mNHVibe.exe
  C:\Windows\System\mNHVibe.exe
  2⤵
  PID:6716
- C:\Windows\System\jXSEVxv.exe
  C:\Windows\System\jXSEVxv.exe
  2⤵
  PID:6748
- C:\Windows\System\QgAmZAx.exe
  C:\Windows\System\QgAmZAx.exe
  2⤵
  PID:6864
- C:\Windows\System\dSkhfsy.exe
  C:\Windows\System\dSkhfsy.exe
  2⤵
  PID:7048
- C:\Windows\System\tnEBRvI.exe
  C:\Windows\System\tnEBRvI.exe
  2⤵
  PID:7032
- C:\Windows\System\yjSfwJP.exe
  C:\Windows\System\yjSfwJP.exe
  2⤵
  PID:5780
- C:\Windows\System\uQqcQKC.exe
  C:\Windows\System\uQqcQKC.exe
  2⤵
  PID:6480
- C:\Windows\System\eBBoFOn.exe
  C:\Windows\System\eBBoFOn.exe
  2⤵
  PID:6768
- C:\Windows\System\ynJEkDT.exe
  C:\Windows\System\ynJEkDT.exe
  2⤵
  PID:6264
- C:\Windows\System\FHyRghb.exe
  C:\Windows\System\FHyRghb.exe
  2⤵
  PID:6836
- C:\Windows\System\OADofXu.exe
  C:\Windows\System\OADofXu.exe
  2⤵
  PID:7100
- C:\Windows\System\hUslRZY.exe
  C:\Windows\System\hUslRZY.exe
  2⤵
  PID:6156
- C:\Windows\System\ldBdyQw.exe
  C:\Windows\System\ldBdyQw.exe
  2⤵
  PID:6916
- C:\Windows\System\LfwSFUa.exe
  C:\Windows\System\LfwSFUa.exe
  2⤵
  PID:6968
- C:\Windows\System\clGoZIQ.exe
  C:\Windows\System\clGoZIQ.exe
  2⤵
  PID:6444
- C:\Windows\System\hOlLdLZ.exe
  C:\Windows\System\hOlLdLZ.exe
  2⤵
  PID:6004
- C:\Windows\System\KuVdbvM.exe
  C:\Windows\System\KuVdbvM.exe
  2⤵
  PID:6640
- C:\Windows\System\zQAzEGT.exe
  C:\Windows\System\zQAzEGT.exe
  2⤵
  PID:6772
- C:\Windows\System\NCpYhtW.exe
  C:\Windows\System\NCpYhtW.exe
  2⤵
  PID:7172
- C:\Windows\System\ggUmoDi.exe
  C:\Windows\System\ggUmoDi.exe
  2⤵
  PID:7188
- C:\Windows\System\KekmMeG.exe
  C:\Windows\System\KekmMeG.exe
  2⤵
  PID:7204
- C:\Windows\System\FWRHUYj.exe
  C:\Windows\System\FWRHUYj.exe
  2⤵
  PID:7220
- C:\Windows\System\UeEbSOr.exe
  C:\Windows\System\UeEbSOr.exe
  2⤵
  PID:7236
- C:\Windows\System\bdFniib.exe
  C:\Windows\System\bdFniib.exe
  2⤵
  PID:7252
- C:\Windows\System\zaiuHqp.exe
  C:\Windows\System\zaiuHqp.exe
  2⤵
  PID:7268
- C:\Windows\System\MBlXZMv.exe
  C:\Windows\System\MBlXZMv.exe
  2⤵
  PID:7284
- C:\Windows\System\JIGHszE.exe
  C:\Windows\System\JIGHszE.exe
  2⤵
  PID:7300
- C:\Windows\System\jlLLGeA.exe
  C:\Windows\System\jlLLGeA.exe
  2⤵
  PID:7316
- C:\Windows\System\vqYbyjC.exe
  C:\Windows\System\vqYbyjC.exe
  2⤵
  PID:7332
- C:\Windows\System\ynsosKm.exe
  C:\Windows\System\ynsosKm.exe
  2⤵
  PID:7348
- C:\Windows\System\JCrDgQd.exe
  C:\Windows\System\JCrDgQd.exe
  2⤵
  PID:7364
- C:\Windows\System\bOthzdu.exe
  C:\Windows\System\bOthzdu.exe
  2⤵
  PID:7380
- C:\Windows\System\KcJbeRW.exe
  C:\Windows\System\KcJbeRW.exe
  2⤵
  PID:7396
- C:\Windows\System\oYdpMle.exe
  C:\Windows\System\oYdpMle.exe
  2⤵
  PID:7412
- C:\Windows\System\wBgawgb.exe
  C:\Windows\System\wBgawgb.exe
  2⤵
  PID:7428
- C:\Windows\System\CiMmZZK.exe
  C:\Windows\System\CiMmZZK.exe
  2⤵
  PID:7444
- C:\Windows\System\NGWaBdN.exe
  C:\Windows\System\NGWaBdN.exe
  2⤵
  PID:7460
- C:\Windows\System\EoVDefm.exe
  C:\Windows\System\EoVDefm.exe
  2⤵
  PID:7476
- C:\Windows\System\sIscZFZ.exe
  C:\Windows\System\sIscZFZ.exe
  2⤵
  PID:7492
- C:\Windows\System\ZVBVFHK.exe
  C:\Windows\System\ZVBVFHK.exe
  2⤵
  PID:7508
- C:\Windows\System\MRRTJue.exe
  C:\Windows\System\MRRTJue.exe
  2⤵
  PID:7524
- C:\Windows\System\DJeJJnl.exe
  C:\Windows\System\DJeJJnl.exe
  2⤵
  PID:7540
- C:\Windows\System\DaBFxWG.exe
  C:\Windows\System\DaBFxWG.exe
  2⤵
  PID:7556
- C:\Windows\System\CfhtABH.exe
  C:\Windows\System\CfhtABH.exe
  2⤵
  PID:7572
- C:\Windows\System\eDQJPWJ.exe
  C:\Windows\System\eDQJPWJ.exe
  2⤵
  PID:7588
- C:\Windows\System\DeqPMLz.exe
  C:\Windows\System\DeqPMLz.exe
  2⤵
  PID:7604
- C:\Windows\System\KRcjalo.exe
  C:\Windows\System\KRcjalo.exe
  2⤵
  PID:7620
- C:\Windows\System\SLuUNAG.exe
  C:\Windows\System\SLuUNAG.exe
  2⤵
  PID:7636
- C:\Windows\System\dxMTjqG.exe
  C:\Windows\System\dxMTjqG.exe
  2⤵
  PID:7652
- C:\Windows\System\hfFkOBs.exe
  C:\Windows\System\hfFkOBs.exe
  2⤵
  PID:7668
- C:\Windows\System\adQneVI.exe
  C:\Windows\System\adQneVI.exe
  2⤵
  PID:7684
- C:\Windows\System\yDJoGDQ.exe
  C:\Windows\System\yDJoGDQ.exe
  2⤵
  PID:7700
- C:\Windows\System\XVfJudU.exe
  C:\Windows\System\XVfJudU.exe
  2⤵
  PID:7716
- C:\Windows\System\CYTxxdI.exe
  C:\Windows\System\CYTxxdI.exe
  2⤵
  PID:7732
- C:\Windows\System\lUvJIdy.exe
  C:\Windows\System\lUvJIdy.exe
  2⤵
  PID:7748
- C:\Windows\System\MJppIJq.exe
  C:\Windows\System\MJppIJq.exe
  2⤵
  PID:7764
- C:\Windows\System\IQzmcDM.exe
  C:\Windows\System\IQzmcDM.exe
  2⤵
  PID:7780
- C:\Windows\System\LzNhhba.exe
  C:\Windows\System\LzNhhba.exe
  2⤵
  PID:7796
- C:\Windows\System\pVRDPPm.exe
  C:\Windows\System\pVRDPPm.exe
  2⤵
  PID:7812
- C:\Windows\System\yPfnPVL.exe
  C:\Windows\System\yPfnPVL.exe
  2⤵
  PID:7828
- C:\Windows\System\JvhJDWN.exe
  C:\Windows\System\JvhJDWN.exe
  2⤵
  PID:7844
- C:\Windows\System\XOqWoWL.exe
  C:\Windows\System\XOqWoWL.exe
  2⤵
  PID:7860
- C:\Windows\System\jrpqffm.exe
  C:\Windows\System\jrpqffm.exe
  2⤵
  PID:7876
- C:\Windows\System\mNnwmuP.exe
  C:\Windows\System\mNnwmuP.exe
  2⤵
  PID:7892
- C:\Windows\System\TWUniop.exe
  C:\Windows\System\TWUniop.exe
  2⤵
  PID:7908
- C:\Windows\System\ugylYqT.exe
  C:\Windows\System\ugylYqT.exe
  2⤵
  PID:7924
- C:\Windows\System\jkOeINh.exe
  C:\Windows\System\jkOeINh.exe
  2⤵
  PID:7940
- C:\Windows\System\qcsRmVa.exe
  C:\Windows\System\qcsRmVa.exe
  2⤵
  PID:7956
- C:\Windows\System\NgAFMYD.exe
  C:\Windows\System\NgAFMYD.exe
  2⤵
  PID:7972
- C:\Windows\System\gpNAQht.exe
  C:\Windows\System\gpNAQht.exe
  2⤵
  PID:7988
- C:\Windows\System\yWfsqWx.exe
  C:\Windows\System\yWfsqWx.exe
  2⤵
  PID:8004
- C:\Windows\System\ZGqrItm.exe
  C:\Windows\System\ZGqrItm.exe
  2⤵
  PID:8020
- C:\Windows\System\mDinJES.exe
  C:\Windows\System\mDinJES.exe
  2⤵
  PID:8036
- C:\Windows\System\NiajiuP.exe
  C:\Windows\System\NiajiuP.exe
  2⤵
  PID:8052
- C:\Windows\System\kzmRnQm.exe
  C:\Windows\System\kzmRnQm.exe
  2⤵
  PID:8068
- C:\Windows\System\lwyEaxf.exe
  C:\Windows\System\lwyEaxf.exe
  2⤵
  PID:8084
- C:\Windows\System\QzvricR.exe
  C:\Windows\System\QzvricR.exe
  2⤵
  PID:8100
- C:\Windows\System\QYjAucr.exe
  C:\Windows\System\QYjAucr.exe
  2⤵
  PID:8116
- C:\Windows\System\AVDWBPB.exe
  C:\Windows\System\AVDWBPB.exe
  2⤵
  PID:8132
- C:\Windows\System\zaifVet.exe
  C:\Windows\System\zaifVet.exe
  2⤵
  PID:8148
- C:\Windows\System\rfHRvLg.exe
  C:\Windows\System\rfHRvLg.exe
  2⤵
  PID:8164
- C:\Windows\System\houLbwk.exe
  C:\Windows\System\houLbwk.exe
  2⤵
  PID:8180
- C:\Windows\System\HZwYXUT.exe
  C:\Windows\System\HZwYXUT.exe
  2⤵
  PID:6736
- C:\Windows\System\TxkJkRv.exe
  C:\Windows\System\TxkJkRv.exe
  2⤵
  PID:7232
- C:\Windows\System\UUYoSvZ.exe
  C:\Windows\System\UUYoSvZ.exe
  2⤵
  PID:7296
- C:\Windows\System\hLvMaaw.exe
  C:\Windows\System\hLvMaaw.exe
  2⤵
  PID:7360
- C:\Windows\System\gnLXkUL.exe
  C:\Windows\System\gnLXkUL.exe
  2⤵
  PID:7424
- C:\Windows\System\bcgZNuR.exe
  C:\Windows\System\bcgZNuR.exe
  2⤵
  PID:7000
- C:\Windows\System\bVjujmT.exe
  C:\Windows\System\bVjujmT.exe
  2⤵
  PID:7520
- C:\Windows\System\eRxrywf.exe
  C:\Windows\System\eRxrywf.exe
  2⤵
  PID:7436
- C:\Windows\System\ezdZInG.exe
  C:\Windows\System\ezdZInG.exe
  2⤵
  PID:7152
- C:\Windows\System\TNSVgHV.exe
  C:\Windows\System\TNSVgHV.exe
  2⤵
  PID:7116
- C:\Windows\System\rRkeIHW.exe
  C:\Windows\System\rRkeIHW.exe
  2⤵
  PID:7244
- C:\Windows\System\nSJJvaG.exe
  C:\Windows\System\nSJJvaG.exe
  2⤵
  PID:7308
- C:\Windows\System\emyeKKe.exe
  C:\Windows\System\emyeKKe.exe
  2⤵
  PID:7372
- C:\Windows\System\MhpwBiZ.exe
  C:\Windows\System\MhpwBiZ.exe
  2⤵
  PID:7472
- C:\Windows\System\pZpycXO.exe
  C:\Windows\System\pZpycXO.exe
  2⤵
  PID:7536
- C:\Windows\System\sgtNlGG.exe
  C:\Windows\System\sgtNlGG.exe
  2⤵
  PID:7612
- C:\Windows\System\KrkpWgS.exe
  C:\Windows\System\KrkpWgS.exe
  2⤵
  PID:7600
- C:\Windows\System\HPruihn.exe
  C:\Windows\System\HPruihn.exe
  2⤵
  PID:7564
- C:\Windows\System\IAbnbUW.exe
  C:\Windows\System\IAbnbUW.exe
  2⤵
  PID:7664
- C:\Windows\System\fPQaQRM.exe
  C:\Windows\System\fPQaQRM.exe
  2⤵
  PID:7696
- C:\Windows\System\GDWOiAN.exe
  C:\Windows\System\GDWOiAN.exe
  2⤵
  PID:7712
- C:\Windows\System\soQLMCA.exe
  C:\Windows\System\soQLMCA.exe
  2⤵
  PID:7808
- C:\Windows\System\kCfJSeH.exe
  C:\Windows\System\kCfJSeH.exe
  2⤵
  PID:7872
- C:\Windows\System\eRjZPWG.exe
  C:\Windows\System\eRjZPWG.exe
  2⤵
  PID:7936
- C:\Windows\System\WgnGHcr.exe
  C:\Windows\System\WgnGHcr.exe
  2⤵
  PID:8000
- C:\Windows\System\cUflFCI.exe
  C:\Windows\System\cUflFCI.exe
  2⤵
  PID:8064
- C:\Windows\System\xNpbIXG.exe
  C:\Windows\System\xNpbIXG.exe
  2⤵
  PID:8128
- C:\Windows\System\vxTtGCH.exe
  C:\Windows\System\vxTtGCH.exe
  2⤵
  PID:6220
- C:\Windows\System\LoQtoAF.exe
  C:\Windows\System\LoQtoAF.exe
  2⤵
  PID:7420
- C:\Windows\System\FHrVjpS.exe
  C:\Windows\System\FHrVjpS.exe
  2⤵
  PID:7548
- C:\Windows\System\vGBzaMz.exe
  C:\Windows\System\vGBzaMz.exe
  2⤵
  PID:7756
- C:\Windows\System\AyKTjUE.exe
  C:\Windows\System\AyKTjUE.exe
  2⤵
  PID:7340
- C:\Windows\System\bjQewzz.exe
  C:\Windows\System\bjQewzz.exe
  2⤵
  PID:7228
- C:\Windows\System\OSsrGYR.exe
  C:\Windows\System\OSsrGYR.exe
  2⤵
  PID:7500
- C:\Windows\System\zkPsDJN.exe
  C:\Windows\System\zkPsDJN.exe
  2⤵
  PID:6056
- C:\Windows\System\PhpehnG.exe
  C:\Windows\System\PhpehnG.exe
  2⤵
  PID:7708
- C:\Windows\System\smquKBM.exe
  C:\Windows\System\smquKBM.exe
  2⤵
  PID:7868
- C:\Windows\System\XnGJBED.exe
  C:\Windows\System\XnGJBED.exe
  2⤵
  PID:8096
- C:\Windows\System\bRZwgWu.exe
  C:\Windows\System\bRZwgWu.exe
  2⤵
  PID:7392
- C:\Windows\System\vomLlZT.exe
  C:\Windows\System\vomLlZT.exe
  2⤵
  PID:7792
- C:\Windows\System\IkgaGIh.exe
  C:\Windows\System\IkgaGIh.exe
  2⤵
  PID:7856
- C:\Windows\System\kTbQkRt.exe
  C:\Windows\System\kTbQkRt.exe
  2⤵
  PID:7920
- C:\Windows\System\uWNLGip.exe
  C:\Windows\System\uWNLGip.exe
  2⤵
  PID:7984
- C:\Windows\System\wfBVWiK.exe
  C:\Windows\System\wfBVWiK.exe
  2⤵
  PID:8080
- C:\Windows\System\keXInpa.exe
  C:\Windows\System\keXInpa.exe
  2⤵
  PID:8172
- C:\Windows\System\AVDNjIP.exe
  C:\Windows\System\AVDNjIP.exe
  2⤵
  PID:8176
- C:\Windows\System\fSsvKbx.exe
  C:\Windows\System\fSsvKbx.exe
  2⤵
  PID:7280
- C:\Windows\System\mQdVagm.exe
  C:\Windows\System\mQdVagm.exe
  2⤵
  PID:7532
- C:\Windows\System\AoNvbIr.exe
  C:\Windows\System\AoNvbIr.exe
  2⤵
  PID:7724
- C:\Windows\System\jANhZxT.exe
  C:\Windows\System\jANhZxT.exe
  2⤵
  PID:7292
- C:\Windows\System\hjSsNFx.exe
  C:\Windows\System\hjSsNFx.exe
  2⤵
  PID:8140
- C:\Windows\System\xsIDsbA.exe
  C:\Windows\System\xsIDsbA.exe
  2⤵
  PID:7852
- C:\Windows\System\eyanKSe.exe
  C:\Windows\System\eyanKSe.exe
  2⤵
  PID:8144
- C:\Windows\System\zYDMzCf.exe
  C:\Windows\System\zYDMzCf.exe
  2⤵
  PID:7996
- C:\Windows\System\RemYbsa.exe
  C:\Windows\System\RemYbsa.exe
  2⤵
  PID:8188
- C:\Windows\System\FfYhbLy.exe
  C:\Windows\System\FfYhbLy.exe
  2⤵
  PID:7728
- C:\Windows\System\ASknveU.exe
  C:\Windows\System\ASknveU.exe
  2⤵
  PID:8048
- C:\Windows\System\ialCCZp.exe
  C:\Windows\System\ialCCZp.exe
  2⤵
  PID:7276
- C:\Windows\System\QsbxFJm.exe
  C:\Windows\System\QsbxFJm.exe
  2⤵
  PID:7468
- C:\Windows\System\UlhwEOe.exe
  C:\Windows\System\UlhwEOe.exe
  2⤵
  PID:8112
- C:\Windows\System\liijMyz.exe
  C:\Windows\System\liijMyz.exe
  2⤵
  PID:6396
- C:\Windows\System\AiyZWol.exe
  C:\Windows\System\AiyZWol.exe
  2⤵
  PID:7584
- C:\Windows\System\mRsZHCu.exe
  C:\Windows\System\mRsZHCu.exe
  2⤵
  PID:7112
- C:\Windows\System\YCJtlfV.exe
  C:\Windows\System\YCJtlfV.exe
  2⤵
  PID:8160
- C:\Windows\System\HeWdhRd.exe
  C:\Windows\System\HeWdhRd.exe
  2⤵
  PID:8200
- C:\Windows\System\onGUOmc.exe
  C:\Windows\System\onGUOmc.exe
  2⤵
  PID:8216
- C:\Windows\System\jlZdZBb.exe
  C:\Windows\System\jlZdZBb.exe
  2⤵
  PID:8232
- C:\Windows\System\vUpbJxu.exe
  C:\Windows\System\vUpbJxu.exe
  2⤵
  PID:8248
- C:\Windows\System\wSMOZyn.exe
  C:\Windows\System\wSMOZyn.exe
  2⤵
  PID:8264
- C:\Windows\System\RUPceoo.exe
  C:\Windows\System\RUPceoo.exe
  2⤵
  PID:8280
- C:\Windows\System\AMbSswU.exe
  C:\Windows\System\AMbSswU.exe
  2⤵
  PID:8296
- C:\Windows\System\lAGHyxa.exe
  C:\Windows\System\lAGHyxa.exe
  2⤵
  PID:8312
- C:\Windows\System\bHEphRB.exe
  C:\Windows\System\bHEphRB.exe
  2⤵
  PID:8328
- C:\Windows\System\DqKLdFN.exe
  C:\Windows\System\DqKLdFN.exe
  2⤵
  PID:8344
- C:\Windows\System\cOGkYWR.exe
  C:\Windows\System\cOGkYWR.exe
  2⤵
  PID:8360
- C:\Windows\System\HlpTGRL.exe
  C:\Windows\System\HlpTGRL.exe
  2⤵
  PID:8376
- C:\Windows\System\BEDInkq.exe
  C:\Windows\System\BEDInkq.exe
  2⤵
  PID:8392
- C:\Windows\System\OwQlYVN.exe
  C:\Windows\System\OwQlYVN.exe
  2⤵
  PID:8408
- C:\Windows\System\iydmugL.exe
  C:\Windows\System\iydmugL.exe
  2⤵
  PID:8424
- C:\Windows\System\crKMIcN.exe
  C:\Windows\System\crKMIcN.exe
  2⤵
  PID:8440
- C:\Windows\System\jJwEWqP.exe
  C:\Windows\System\jJwEWqP.exe
  2⤵
  PID:8456
- C:\Windows\System\xSfyidv.exe
  C:\Windows\System\xSfyidv.exe
  2⤵
  PID:8472
- C:\Windows\System\GMZUjQy.exe
  C:\Windows\System\GMZUjQy.exe
  2⤵
  PID:8488
- C:\Windows\System\RBfpHEo.exe
  C:\Windows\System\RBfpHEo.exe
  2⤵
  PID:8504
- C:\Windows\System\pAebVmc.exe
  C:\Windows\System\pAebVmc.exe
  2⤵
  PID:8520
- C:\Windows\System\xYvuvKc.exe
  C:\Windows\System\xYvuvKc.exe
  2⤵
  PID:8536
- C:\Windows\System\OjBoYde.exe
  C:\Windows\System\OjBoYde.exe
  2⤵
  PID:8552
- C:\Windows\System\xnOUXEA.exe
  C:\Windows\System\xnOUXEA.exe
  2⤵
  PID:8568
- C:\Windows\System\gbVFyoK.exe
  C:\Windows\System\gbVFyoK.exe
  2⤵
  PID:8584
- C:\Windows\System\eXjFEgU.exe
  C:\Windows\System\eXjFEgU.exe
  2⤵
  PID:8600
- C:\Windows\System\ttYgEbC.exe
  C:\Windows\System\ttYgEbC.exe
  2⤵
  PID:8616
- C:\Windows\System\ykLzkDp.exe
  C:\Windows\System\ykLzkDp.exe
  2⤵
  PID:8632
- C:\Windows\System\UgpCNfm.exe
  C:\Windows\System\UgpCNfm.exe
  2⤵
  PID:8648
- C:\Windows\System\IjrnqXQ.exe
  C:\Windows\System\IjrnqXQ.exe
  2⤵
  PID:8664
- C:\Windows\System\wAWEQQJ.exe
  C:\Windows\System\wAWEQQJ.exe
  2⤵
  PID:8680
- C:\Windows\System\TTndRzN.exe
  C:\Windows\System\TTndRzN.exe
  2⤵
  PID:8696
- C:\Windows\System\yJZOnbt.exe
  C:\Windows\System\yJZOnbt.exe
  2⤵
  PID:8712
- C:\Windows\System\GwQpqOG.exe
  C:\Windows\System\GwQpqOG.exe
  2⤵
  PID:8728
- C:\Windows\System\AqNjSEJ.exe
  C:\Windows\System\AqNjSEJ.exe
  2⤵
  PID:8744
- C:\Windows\System\zSWRigZ.exe
  C:\Windows\System\zSWRigZ.exe
  2⤵
  PID:8760
- C:\Windows\System\GHXLyWJ.exe
  C:\Windows\System\GHXLyWJ.exe
  2⤵
  PID:8776
- C:\Windows\System\RAKrBOZ.exe
  C:\Windows\System\RAKrBOZ.exe
  2⤵
  PID:8792
- C:\Windows\System\kjfUdHx.exe
  C:\Windows\System\kjfUdHx.exe
  2⤵
  PID:8808
- C:\Windows\System\BsAsUkg.exe
  C:\Windows\System\BsAsUkg.exe
  2⤵
  PID:8824
- C:\Windows\System\ukniBXV.exe
  C:\Windows\System\ukniBXV.exe
  2⤵
  PID:8840
- C:\Windows\System\fWkfAYr.exe
  C:\Windows\System\fWkfAYr.exe
  2⤵
  PID:8856
- C:\Windows\System\HGmNstk.exe
  C:\Windows\System\HGmNstk.exe
  2⤵
  PID:8872
- C:\Windows\System\LIXyVca.exe
  C:\Windows\System\LIXyVca.exe
  2⤵
  PID:8888
- C:\Windows\System\PHSClfC.exe
  C:\Windows\System\PHSClfC.exe
  2⤵
  PID:8904
- C:\Windows\System\ogmiMgU.exe
  C:\Windows\System\ogmiMgU.exe
  2⤵
  PID:8920
- C:\Windows\System\ejYvXpb.exe
  C:\Windows\System\ejYvXpb.exe
  2⤵
  PID:8936
- C:\Windows\System\rmJEjSK.exe
  C:\Windows\System\rmJEjSK.exe
  2⤵
  PID:8952
- C:\Windows\System\sprZnJP.exe
  C:\Windows\System\sprZnJP.exe
  2⤵
  PID:8968
- C:\Windows\System\RWgoGOa.exe
  C:\Windows\System\RWgoGOa.exe
  2⤵
  PID:8984
- C:\Windows\System\HMhXxvY.exe
  C:\Windows\System\HMhXxvY.exe
  2⤵
  PID:9000
- C:\Windows\System\YGKodHt.exe
  C:\Windows\System\YGKodHt.exe
  2⤵
  PID:9016
- C:\Windows\System\zEPeIfY.exe
  C:\Windows\System\zEPeIfY.exe
  2⤵
  PID:9032
- C:\Windows\System\YhoOrau.exe
  C:\Windows\System\YhoOrau.exe
  2⤵
  PID:9048
- C:\Windows\System\riaxdtn.exe
  C:\Windows\System\riaxdtn.exe
  2⤵
  PID:9064
- C:\Windows\System\LWsiODJ.exe
  C:\Windows\System\LWsiODJ.exe
  2⤵
  PID:9080
- C:\Windows\System\HVCOgng.exe
  C:\Windows\System\HVCOgng.exe
  2⤵
  PID:9096
- C:\Windows\System\feqLJVb.exe
  C:\Windows\System\feqLJVb.exe
  2⤵
  PID:9112
- C:\Windows\System\Rbwluaa.exe
  C:\Windows\System\Rbwluaa.exe
  2⤵
  PID:9128
- C:\Windows\System\ySAduSn.exe
  C:\Windows\System\ySAduSn.exe
  2⤵
  PID:9144
- C:\Windows\System\HSWsaOM.exe
  C:\Windows\System\HSWsaOM.exe
  2⤵
  PID:9160
- C:\Windows\System\QDjbjrk.exe
  C:\Windows\System\QDjbjrk.exe
  2⤵
  PID:9176
- C:\Windows\System\cPRbFMR.exe
  C:\Windows\System\cPRbFMR.exe
  2⤵
  PID:9192
- C:\Windows\System\AipDxzl.exe
  C:\Windows\System\AipDxzl.exe
  2⤵
  PID:9208
- C:\Windows\System\tmgoUNJ.exe
  C:\Windows\System\tmgoUNJ.exe
  2⤵
  PID:7836
- C:\Windows\System\lghCGYp.exe
  C:\Windows\System\lghCGYp.exe
  2⤵
  PID:7692
- C:\Windows\System\qLINEuO.exe
  C:\Windows\System\qLINEuO.exe
  2⤵
  PID:8256
- C:\Windows\System\PuOyIrG.exe
  C:\Windows\System\PuOyIrG.exe
  2⤵
  PID:8292
- C:\Windows\System\ZImxcRq.exe
  C:\Windows\System\ZImxcRq.exe
  2⤵
  PID:8356
- C:\Windows\System\DoBNPYd.exe
  C:\Windows\System\DoBNPYd.exe
  2⤵
  PID:8420
- C:\Windows\System\kQGsJoG.exe
  C:\Windows\System\kQGsJoG.exe
  2⤵
  PID:8480
- C:\Windows\System\tldtgix.exe
  C:\Windows\System\tldtgix.exe
  2⤵
  PID:7680
- C:\Windows\System\hrrBaii.exe
  C:\Windows\System\hrrBaii.exe
  2⤵
  PID:8212
- C:\Windows\System\hSdfEHR.exe
  C:\Windows\System\hSdfEHR.exe
  2⤵
  PID:8272
- C:\Windows\System\iySxnCx.exe
  C:\Windows\System\iySxnCx.exe
  2⤵
  PID:8544
- C:\Windows\System\SAJapOu.exe
  C:\Windows\System\SAJapOu.exe
  2⤵
  PID:8496
- C:\Windows\System\vglZuOS.exe
  C:\Windows\System\vglZuOS.exe
  2⤵
  PID:8336
- C:\Windows\System\IYczHGX.exe
  C:\Windows\System\IYczHGX.exe
  2⤵
  PID:8532
- C:\Windows\System\SXNvmLB.exe
  C:\Windows\System\SXNvmLB.exe
  2⤵
  PID:8608
- C:\Windows\System\NgFTmbk.exe
  C:\Windows\System\NgFTmbk.exe
  2⤵
  PID:8644
- C:\Windows\System\brcVOWa.exe
  C:\Windows\System\brcVOWa.exe
  2⤵
  PID:8676
- C:\Windows\System\vAMgYuG.exe
  C:\Windows\System\vAMgYuG.exe
  2⤵
  PID:8660
- C:\Windows\System\SihgizK.exe
  C:\Windows\System\SihgizK.exe
  2⤵
  PID:8736
- C:\Windows\System\ZrRmLRx.exe
  C:\Windows\System\ZrRmLRx.exe
  2⤵
  PID:8800
- C:\Windows\System\UzDzbUQ.exe
  C:\Windows\System\UzDzbUQ.exe
  2⤵
  PID:8864
- C:\Windows\System\BQFbnZB.exe
  C:\Windows\System\BQFbnZB.exe
  2⤵
  PID:8928
- C:\Windows\System\PxzMLpi.exe
  C:\Windows\System\PxzMLpi.exe
  2⤵
  PID:8960
- C:\Windows\System\IgKOyzs.exe
  C:\Windows\System\IgKOyzs.exe
  2⤵
  PID:8720
- C:\Windows\System\deXEOmG.exe
  C:\Windows\System\deXEOmG.exe
  2⤵
  PID:8784
- C:\Windows\System\uUpPqKY.exe
  C:\Windows\System\uUpPqKY.exe
  2⤵
  PID:8852
- C:\Windows\System\mDsQLkP.exe
  C:\Windows\System\mDsQLkP.exe
  2⤵
  PID:8980
- C:\Windows\System\DzLTmHI.exe
  C:\Windows\System\DzLTmHI.exe
  2⤵
  PID:8948
- C:\Windows\System\WLgKIiP.exe
  C:\Windows\System\WLgKIiP.exe
  2⤵
  PID:9012
- C:\Windows\System\tgQyCYn.exe
  C:\Windows\System\tgQyCYn.exe
  2⤵
  PID:9088
- C:\Windows\System\oiDiMyB.exe
  C:\Windows\System\oiDiMyB.exe
  2⤵
  PID:9076
- C:\Windows\System\bjjTLql.exe
  C:\Windows\System\bjjTLql.exe
  2⤵
  PID:9124
- C:\Windows\System\oTcDCKz.exe
  C:\Windows\System\oTcDCKz.exe
  2⤵
  PID:9136
- C:\Windows\System\vYXqAIG.exe
  C:\Windows\System\vYXqAIG.exe
  2⤵
  PID:9188
- C:\Windows\System\qxpsXLJ.exe
  C:\Windows\System\qxpsXLJ.exe
  2⤵
  PID:8228
- C:\Windows\System\tQcRUrW.exe
  C:\Windows\System\tQcRUrW.exe
  2⤵
  PID:8404
- C:\Windows\System\mVqrUiy.exe
  C:\Windows\System\mVqrUiy.exe
  2⤵
  PID:8340
- C:\Windows\System\eKXpPlJ.exe
  C:\Windows\System\eKXpPlJ.exe
  2⤵
  PID:9200
- C:\Windows\System\zAtwvey.exe
  C:\Windows\System\zAtwvey.exe
  2⤵
  PID:8708
- C:\Windows\System\umocRHJ.exe
  C:\Windows\System\umocRHJ.exe
  2⤵
  PID:8692
- C:\Windows\System\ScFjcxX.exe
  C:\Windows\System\ScFjcxX.exe
  2⤵
  PID:8288
- C:\Windows\System\nTzBiAB.exe
  C:\Windows\System\nTzBiAB.exe
  2⤵
  PID:8372
- C:\Windows\System\lNQyYdb.exe
  C:\Windows\System\lNQyYdb.exe
  2⤵
  PID:9044
- C:\Windows\System\ZddwBXU.exe
  C:\Windows\System\ZddwBXU.exe
  2⤵
  PID:9184
- C:\Windows\System\GagGyeW.exe
  C:\Windows\System\GagGyeW.exe
  2⤵
  PID:8308
- C:\Windows\System\aMVBSaW.exe
  C:\Windows\System\aMVBSaW.exe
  2⤵
  PID:7980
- C:\Windows\System\rsEdNlm.exe
  C:\Windows\System\rsEdNlm.exe
  2⤵
  PID:6704
- C:\Windows\System\YWPCGxM.exe
  C:\Windows\System\YWPCGxM.exe
  2⤵
  PID:8416
- C:\Windows\System\XhlkwQk.exe
  C:\Windows\System\XhlkwQk.exe
  2⤵
  PID:9008
- C:\Windows\System\rXYGBaK.exe
  C:\Windows\System\rXYGBaK.exe
  2⤵
  PID:9224
- C:\Windows\System\orGInQu.exe
  C:\Windows\System\orGInQu.exe
  2⤵
  PID:9240
- C:\Windows\System\lckBbyD.exe
  C:\Windows\System\lckBbyD.exe
  2⤵
  PID:9256
- C:\Windows\System\kItECTU.exe
  C:\Windows\System\kItECTU.exe
  2⤵
  PID:9272
- C:\Windows\System\nvchQoS.exe
  C:\Windows\System\nvchQoS.exe
  2⤵
  PID:9288
- C:\Windows\System\PmxwYBX.exe
  C:\Windows\System\PmxwYBX.exe
  2⤵
  PID:9304
- C:\Windows\System\tkJlZkw.exe
  C:\Windows\System\tkJlZkw.exe
  2⤵
  PID:9320
- C:\Windows\System\tQzPCGR.exe
  C:\Windows\System\tQzPCGR.exe
  2⤵
  PID:9336
- C:\Windows\System\oZoHagF.exe
  C:\Windows\System\oZoHagF.exe
  2⤵
  PID:9352
- C:\Windows\System\KprJWCD.exe
  C:\Windows\System\KprJWCD.exe
  2⤵
  PID:9368
- C:\Windows\System\rblkpdR.exe
  C:\Windows\System\rblkpdR.exe
  2⤵
  PID:9384
- C:\Windows\System\JbDLutw.exe
  C:\Windows\System\JbDLutw.exe
  2⤵
  PID:9400
- C:\Windows\System\ODqjpRI.exe
  C:\Windows\System\ODqjpRI.exe
  2⤵
  PID:9416
- C:\Windows\System\VltuuLe.exe
  C:\Windows\System\VltuuLe.exe
  2⤵
  PID:9432
- C:\Windows\System\oNEAYWd.exe
  C:\Windows\System\oNEAYWd.exe
  2⤵
  PID:9448
- C:\Windows\System\LWuzUCb.exe
  C:\Windows\System\LWuzUCb.exe
  2⤵
  PID:9468
- C:\Windows\System\CzWOpJZ.exe
  C:\Windows\System\CzWOpJZ.exe
  2⤵
  PID:9484
- C:\Windows\System\SckoNgT.exe
  C:\Windows\System\SckoNgT.exe
  2⤵
  PID:9500
- C:\Windows\System\HrbDYzw.exe
  C:\Windows\System\HrbDYzw.exe
  2⤵
  PID:9516
- C:\Windows\System\PTVeSTJ.exe
  C:\Windows\System\PTVeSTJ.exe
  2⤵
  PID:9532
- C:\Windows\System\zzvWJPg.exe
  C:\Windows\System\zzvWJPg.exe
  2⤵
  PID:9548
- C:\Windows\System\jUSPLiy.exe
  C:\Windows\System\jUSPLiy.exe
  2⤵
  PID:9564
- C:\Windows\System\tUqjlDv.exe
  C:\Windows\System\tUqjlDv.exe
  2⤵
  PID:9580
- C:\Windows\System\vHVbohV.exe
  C:\Windows\System\vHVbohV.exe
  2⤵
  PID:9600
- C:\Windows\System\aglDGRU.exe
  C:\Windows\System\aglDGRU.exe
  2⤵
  PID:9616
- C:\Windows\System\cwYKZys.exe
  C:\Windows\System\cwYKZys.exe
  2⤵
  PID:9632
- C:\Windows\System\srdHppf.exe
  C:\Windows\System\srdHppf.exe
  2⤵
  PID:9648
- C:\Windows\System\jyxdcBy.exe
  C:\Windows\System\jyxdcBy.exe
  2⤵
  PID:9664
- C:\Windows\System\QjmODNS.exe
  C:\Windows\System\QjmODNS.exe
  2⤵
  PID:9680
- C:\Windows\System\sshphXN.exe
  C:\Windows\System\sshphXN.exe
  2⤵
  PID:9696
- C:\Windows\System\zzqFKRb.exe
  C:\Windows\System\zzqFKRb.exe
  2⤵
  PID:9712
- C:\Windows\System\llMzLUm.exe
  C:\Windows\System\llMzLUm.exe
  2⤵
  PID:9728
- C:\Windows\System\dnsWlfl.exe
  C:\Windows\System\dnsWlfl.exe
  2⤵
  PID:9744
- C:\Windows\System\mqPPcbu.exe
  C:\Windows\System\mqPPcbu.exe
  2⤵
  PID:9760
- C:\Windows\System\AGDcjlN.exe
  C:\Windows\System\AGDcjlN.exe
  2⤵
  PID:9776
- C:\Windows\System\wYLDcrG.exe
  C:\Windows\System\wYLDcrG.exe
  2⤵
  PID:9792
- C:\Windows\System\MYHMkmY.exe
  C:\Windows\System\MYHMkmY.exe
  2⤵
  PID:9808
- C:\Windows\System\WbwRuQh.exe
  C:\Windows\System\WbwRuQh.exe
  2⤵
  PID:9824
- C:\Windows\System\diEvfqB.exe
  C:\Windows\System\diEvfqB.exe
  2⤵
  PID:9840
- C:\Windows\System\slQlOOs.exe
  C:\Windows\System\slQlOOs.exe
  2⤵
  PID:9856
- C:\Windows\System\awMhCwT.exe
  C:\Windows\System\awMhCwT.exe
  2⤵
  PID:9872
- C:\Windows\System\cTCvYBO.exe
  C:\Windows\System\cTCvYBO.exe
  2⤵
  PID:9888
- C:\Windows\System\naHgOoZ.exe
  C:\Windows\System\naHgOoZ.exe
  2⤵
  PID:9904
- C:\Windows\System\pLoYKuw.exe
  C:\Windows\System\pLoYKuw.exe
  2⤵
  PID:9920
- C:\Windows\System\BJrbifA.exe
  C:\Windows\System\BJrbifA.exe
  2⤵
  PID:9936
- C:\Windows\System\mYAeAKL.exe
  C:\Windows\System\mYAeAKL.exe
  2⤵
  PID:9952
- C:\Windows\System\UEArbBg.exe
  C:\Windows\System\UEArbBg.exe
  2⤵
  PID:9968
- C:\Windows\System\legFKPE.exe
  C:\Windows\System\legFKPE.exe
  2⤵
  PID:9984
- C:\Windows\System\pSCSoZi.exe
  C:\Windows\System\pSCSoZi.exe
  2⤵
  PID:10000
- C:\Windows\System\gnmVIfN.exe
  C:\Windows\System\gnmVIfN.exe
  2⤵
  PID:10016
- C:\Windows\System\NlgieME.exe
  C:\Windows\System\NlgieME.exe
  2⤵
  PID:10032
- C:\Windows\System\ianGCrj.exe
  C:\Windows\System\ianGCrj.exe
  2⤵
  PID:10048
- C:\Windows\System\lkbVBKm.exe
  C:\Windows\System\lkbVBKm.exe
  2⤵
  PID:10100
- C:\Windows\System\FCOVKfB.exe
  C:\Windows\System\FCOVKfB.exe
  2⤵
  PID:10120
- C:\Windows\System\leWPWGZ.exe
  C:\Windows\System\leWPWGZ.exe
  2⤵
  PID:10136
- C:\Windows\System\RULhxFe.exe
  C:\Windows\System\RULhxFe.exe
  2⤵
  PID:10152
- C:\Windows\System\zagrLou.exe
  C:\Windows\System\zagrLou.exe
  2⤵
  PID:10168
- C:\Windows\System\gGICHNK.exe
  C:\Windows\System\gGICHNK.exe
  2⤵
  PID:10192
- C:\Windows\System\qGWDaxT.exe
  C:\Windows\System\qGWDaxT.exe
  2⤵
  PID:10212
- C:\Windows\System\qLHGtQx.exe
  C:\Windows\System\qLHGtQx.exe
  2⤵
  PID:10228
- C:\Windows\System\sHoMobL.exe
  C:\Windows\System\sHoMobL.exe
  2⤵
  PID:8640
- C:\Windows\System\LFHAPvf.exe
  C:\Windows\System\LFHAPvf.exe
  2⤵
  PID:9296
- C:\Windows\System\CYCvnDT.exe
  C:\Windows\System\CYCvnDT.exe
  2⤵
  PID:9360
- C:\Windows\System\EFWJhln.exe
  C:\Windows\System\EFWJhln.exe
  2⤵
  PID:9424
- C:\Windows\System\CRCrLLp.exe
  C:\Windows\System\CRCrLLp.exe
  2⤵
  PID:9456
- C:\Windows\System\DcdxMSr.exe
  C:\Windows\System\DcdxMSr.exe
  2⤵
  PID:8436
- C:\Windows\System\uHWjBWj.exe
  C:\Windows\System\uHWjBWj.exe
  2⤵
  PID:9108
- C:\Windows\System\uKhtWIh.exe
  C:\Windows\System\uKhtWIh.exe
  2⤵
  PID:8352
- C:\Windows\System\NZEdtQU.exe
  C:\Windows\System\NZEdtQU.exe
  2⤵
  PID:1592
- C:\Windows\System\yBAvEng.exe
  C:\Windows\System\yBAvEng.exe
  2⤵
  PID:9204
- C:\Windows\System\UroAFVO.exe
  C:\Windows\System\UroAFVO.exe
  2⤵
  PID:9460
- C:\Windows\System\KLksZsE.exe
  C:\Windows\System\KLksZsE.exe
  2⤵
  PID:9040
- C:\Windows\System\jdBSixi.exe
  C:\Windows\System\jdBSixi.exe
  2⤵
  PID:9168
- C:\Windows\System\cMADJfe.exe
  C:\Windows\System\cMADJfe.exe
  2⤵
  PID:8240
- C:\Windows\System\qgfnhBN.exe
  C:\Windows\System\qgfnhBN.exe
  2⤵
  PID:9248
- C:\Windows\System\UvvqFsx.exe
  C:\Windows\System\UvvqFsx.exe
  2⤵
  PID:9312
- C:\Windows\System\jwOUsxe.exe
  C:\Windows\System\jwOUsxe.exe
  2⤵
  PID:9376
- C:\Windows\System\RPOiFoQ.exe
  C:\Windows\System\RPOiFoQ.exe
  2⤵
  PID:9444
- C:\Windows\System\NJjghpw.exe
  C:\Windows\System\NJjghpw.exe
  2⤵
  PID:9524
- C:\Windows\System\bafYcGi.exe
  C:\Windows\System\bafYcGi.exe
  2⤵
  PID:9592
- C:\Windows\System\UAQuXjV.exe
  C:\Windows\System\UAQuXjV.exe
  2⤵
  PID:9624
- C:\Windows\System\DPvnENt.exe
  C:\Windows\System\DPvnENt.exe
  2⤵
  PID:9720
- C:\Windows\System\VtgYhVD.exe
  C:\Windows\System\VtgYhVD.exe
  2⤵
  PID:9640
- C:\Windows\System\xZTHbGr.exe
  C:\Windows\System\xZTHbGr.exe
  2⤵
  PID:9508
- C:\Windows\System\tTdkfrg.exe
  C:\Windows\System\tTdkfrg.exe
  2⤵
  PID:9572
- C:\Windows\System\tkZjSeT.exe
  C:\Windows\System\tkZjSeT.exe
  2⤵
  PID:9708
- C:\Windows\System\mloDAMS.exe
  C:\Windows\System\mloDAMS.exe
  2⤵
  PID:9820
- C:\Windows\System\fPXhmdN.exe
  C:\Windows\System\fPXhmdN.exe
  2⤵
  PID:9756
- C:\Windows\System\FIWCaHD.exe
  C:\Windows\System\FIWCaHD.exe
  2⤵
  PID:9848
- C:\Windows\System\bbndZOu.exe
  C:\Windows\System\bbndZOu.exe
  2⤵
  PID:9948
- C:\Windows\System\YSkcSaF.exe
  C:\Windows\System\YSkcSaF.exe
  2⤵
  PID:10012
- C:\Windows\System\byXgxnh.exe
  C:\Windows\System\byXgxnh.exe
  2⤵
  PID:9772
- C:\Windows\System\CjBTonM.exe
  C:\Windows\System\CjBTonM.exe
  2⤵
  PID:9836
- C:\Windows\System\edINeKb.exe
  C:\Windows\System\edINeKb.exe
  2⤵
  PID:9900
- C:\Windows\System\tIwtJDJ.exe
  C:\Windows\System\tIwtJDJ.exe
  2⤵
  PID:9964
- C:\Windows\System\BYzaMwD.exe
  C:\Windows\System\BYzaMwD.exe
  2⤵
  PID:10028
- C:\Windows\System\VdxqxoI.exe
  C:\Windows\System\VdxqxoI.exe
  2⤵
  PID:10088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Awastli.exe

Filesize
1.9MB

MD5
4f7e8c7b49646ab6d44994be043894bb

SHA1
062702f2ff02c64c2ef4e94d91e71d081022d250

SHA256
ae8850be61522f1d452e262054a490a445501d962b6b76ddf16b51c4eeed1ab0

SHA512
5a8c6ac88a3052ac5afb3aba40216a77306a79024f84835528f9193f20f3edaaa99d6ef4e108e3ccae9c05cf0e2d110cc0134b17ed4c3a0594665bb74ae17322

Download Submit
C:\Windows\system\EnuECjy.exe

Filesize
1.9MB

MD5
f2e0c4700d80fde13baae1a02ae68cab

SHA1
c2cfa4f0722168a5dd76ea640fe2fa5dbedfeb90

SHA256
b234b87b7e68e5e40b78659eaa5bc1b9f52b7228239be530cc5034ef1d45a97b

SHA512
a8ee0a398ba06e9c0c3d093c6f079c77322e511b769c993c7b9b8674061a0816ba25c1a07348d756052135be4ccc8f5b7bac530fd341d068492732559685a4b8

Download Submit
C:\Windows\system\JGbsgWf.exe

Filesize
1.9MB

MD5
9f4d86a362acba3bd1adb9a6835b3a4b

SHA1
13e065eafd82a28aa8d14d7eaa8b576a3ffe0f9d

SHA256
76a15b8543f6f82fc8e6b269ae21c804aca14d89053348be0902de2fe0c37671

SHA512
cc8e112b1f9e0348503012aa09088ec1fdb607c9c578cac4a4eae7e1b1a612cfebb77217366d902f9cbb3f619dcbbf344b75827974c01cbc13d2fe9a54218d33

Download Submit
C:\Windows\system\LkrMyOa.exe

Filesize
1.9MB

MD5
d53d3f7e1e254d8bbdad390c32fcd585

SHA1
5994f3c05c86ba31a41cf158bc30ea662bba6b8d

SHA256
a9490a22d1aec81f2d48f2636155c399d364c760cb0e474b39290bc1786fdaf5

SHA512
218bd041ac981f9637ebba99e48a861eeed1d0b04e5e3e22946357195e3305f680276e6e00d9b44e37bc90ba8bb0078a0488b131a20c7c9c9432ffdd4e7b32af

Download Submit
C:\Windows\system\NAKHSbs.exe

Filesize
1.9MB

MD5
bf9c7731677ef32fcabb7392d8046a88

SHA1
be0e7ff1a3dbb60ab1ca78836e5762ed68c009a4

SHA256
5342cdd2ad716aac5e9816f2bf5afda981e8ba843b9787d534493b0dd89ff451

SHA512
d554a1721c7328f9287861572bc91c0cc2c31338087c268a5a9797e8bc33a85959221e2bc9134e71bf4c91019ce9f4d49afa802a9ab7cb1c99e153dee687e3cf

Download Submit
C:\Windows\system\PRAInMN.exe

Filesize
1.9MB

MD5
9bfc3c6c5b0934644970268953c87753

SHA1
4d8fb738d3e138e175aa23b27bb4e84ec2efeddc

SHA256
cb14f161065cec6483a42acf74b93607b359a8893ed8aae4be9c8d3907b922f8

SHA512
0bc9c6a661e3fc906a1d0c9675c003ce88ebb727ec84eda6c65cbad160335703b13ca5618231a36a040cd7d9c92a5440ba71a082c398a2a489ce260f90009716

Download Submit
C:\Windows\system\QYzPjLm.exe

Filesize
1.9MB

MD5
43e1cfd2ca158dbaf2fa1a9fdb93959c

SHA1
42a98de8e797e3abd2e28fa98f2ced07a72da834

SHA256
b0e81f62a977b56b151618923d79c2e0fec9893dd353cd4df9b3818609c2fa9e

SHA512
f296c2f32704947c3873e049c0ccd7bb36ee32c733e3217970a11ae32a129c109184268967c292ea96f4369ccd9ac113f593efd87d333730f11ec2e1e944cead

Download Submit
C:\Windows\system\SIMsaUJ.exe

Filesize
1.9MB

MD5
9a72e2620d0a17fe2de9ff9b2145250f

SHA1
11de5edbc547116f5e4a78e790b4d5fc9093754b

SHA256
ad28dc9f50aa12e3aae91d29d83c4824bcdf347d711306b4caa5d273c3b2c3ab

SHA512
461460afd63589e4a578d79d3d9c899dbcc2c9aeac7f6ba149bb308ade7d5442963ba7acb6a3cf56728809c05bb999a521b94e44b97e0f2cd5b8e5bbc94f384e

Download Submit
C:\Windows\system\TdvwuJP.exe

Filesize
1.9MB

MD5
ba8974c5b44e7ed34a70379000bc96be

SHA1
78b680e9a5ee76bcb2dc899ba51680534dd6e57b

SHA256
7f4763838da6bf777068c85772d08f9494aeaf88a209af7ed2ef36bcc4727323

SHA512
67cf833a30a6a5f37a5e3136f51a386c049ec241a53b12f6cd4b82a330418a698feaacccb935a9b3e59122d32dbee76f6f985f453160e2da94d97895915dc997

Download Submit
C:\Windows\system\VsQTIGf.exe

Filesize
1.9MB

MD5
41bd807a0a0617d721066b815ac3c8cb

SHA1
bd8039f4bb6426b52d9f3e94b105a8202ce118d7

SHA256
99e7741d8365879a8c754e0844d2a617717048fed9ebc6d64eb38f998c7ac938

SHA512
ff494ee9cbdd88a64da1871e14edf5eaf8b872909a97420a2b476163da179e7fdb1aeeb1e01b9608735e43613895686045d3d3186a569423c392684bd4a46d25

Download Submit
C:\Windows\system\XvcYEqe.exe

Filesize
1.9MB

MD5
b3dc62a5daa730e86bff0a30a846ec82

SHA1
07bc0b349f221f0517f854a167773b237a67c233

SHA256
30771708ff92a26236b6fd18e8e419bfb81f2bd78372ceaa92975a9a730f3004

SHA512
36aa7d6483b3a5448851f91350bce17434633dcd68c7d0c4a5ad20967e1df1387fe8ad94fe13df236fd958cc75597bfe31c16eef97f54625a7a50e8aa385f958

Download Submit
C:\Windows\system\YMuSzSD.exe

Filesize
1.9MB

MD5
a9e8ee67fdc32c7a71602aac0b907215

SHA1
8aaf87643d1df51b4799e1d89b7af20dee1ea2d8

SHA256
46f46ecdf1b569b09d37a6d80308d5cd4f33d47a3e0b48047df1b9945e64e169

SHA512
a88359a510f1156c9d66a18984025567b559257e0de47c1af09f0e58ca37f9122dae95e2a5d21097b3fbaeac33cdaf5c33aad42308e0827a8f360cf7d3aeca87

Download Submit
C:\Windows\system\bIfhHsu.exe

Filesize
1.9MB

MD5
cc35cd9c91e93383af9927c3cd0ce45f

SHA1
31673565111c181ebad24056eabaf77f197d7de0

SHA256
cda1bc2919542c2122de4119f58dc5eda053e75b850015442562982dbc84eb31

SHA512
bb6ecae3ac4287769110c6de34abf608c7b5454244c10f47e8da789885242d79d26279e7efc15a8d680d6b9d8c49889c945dc0bd6a7d276b44197917c5ddd721

Download Submit
C:\Windows\system\cMYhdCl.exe

Filesize
1.9MB

MD5
11205fb4da617be6cdb09f7233690cef

SHA1
ded2146017834b9a47b23a6aaafd19475236ef32

SHA256
1f8cf35b51750bb76ce118884a354a229245f0225190ab5b9b60a9d9ae8a718a

SHA512
993c8f7064c25b7dd7eedfc3af2a23a00f974d3725fc33f8d37fb09f25faac886735f04c22065a1c8969aed1923b94294cd9913f8a0f4da1ca225fbe909c7112

Download Submit
C:\Windows\system\celTGIU.exe

Filesize
1.9MB

MD5
d8b70998a9ebba7f5f627f48ef389670

SHA1
1b6b18497ec78976c291666ea71b985b1ea3c266

SHA256
6aa4359393d2065b0c8670f4a31e87209cfb8160513cedbf4e042780d966586f

SHA512
22097b5e3ac5bdf300474479e4070f3e8eb61181923b1245996ed9876a4a01049cf8b3930aa2b0bfb3349502919c753eccc2ecbe5fdfd2cbe03e73a5dcef8393

Download Submit
C:\Windows\system\dZhyEhY.exe

Filesize
1.9MB

MD5
ad8dfce7f024f823bf839d6715df0c74

SHA1
f46ae1bb139973420d91f47f0f64fbf65067bb28

SHA256
1bce3bf443d52c434217d48fc87a13143de041db50436a5d9fe1c183e4e31d2f

SHA512
8b1234b79cdf8bffbafe257789fac1501f72f566b8d3755b8c147e17e0fbbe2dd3613cec9241db3dcd739b578b5d80fdced962f80f85a21730e392db3f8aa3e5

Download Submit
C:\Windows\system\drWvdBy.exe

Filesize
1.9MB

MD5
4c5ef7e6d3c6438a5c0692d3e750ccc8

SHA1
0c9c399a5269f0e9e97f4d8643f22c8d8eefc63d

SHA256
b3131a4f51768e38c46d5cf9ca8d4c40a9b1314ca9ccd33a2ed05c11b28d8043

SHA512
782233b46e6171903ed42c583c100f371af48ce78f1b0c5523ca5bad254187689c13a8fee44180215be636c2d44fc38cb2721d5e08362bc33f9f9022f1a209cd

Download Submit
C:\Windows\system\eSVjxxo.exe

Filesize
1.9MB

MD5
3299473bec32ebc610baf361e066b8bc

SHA1
9f9822a01a50a910dcf645dbdb0ccde08995ebe0

SHA256
b8e105c4dd33349679bdde495c03bd81cb9a02e7688838a2857eb7dbaccaf1f1

SHA512
8d386c75f349cce2947bbf51cc8802d6e1ac6d41bfea6fdee297823974450806f9bd4ec065a303de3c2b7952bc53c4f47155f42a9c18101f485ad8f0adb88a74

Download Submit
C:\Windows\system\hQBYmHB.exe

Filesize
1.9MB

MD5
23f7e249957d568bb2771e79cbbef048

SHA1
bf178557f6d6c7c991660253c15e8ae9e4efaaff

SHA256
5438f5d1025b64fb24d07bb4087995208bfe1acefa7d1be08f34d5215d0e9890

SHA512
19c13990093ee44cee53f52818222dca5f98ba7d0f68c5c5e81bea0ea6399129b73dce062c636e48da4bc96ab6111d640c2e758b406add648192e02c2f9e5667

Download Submit
C:\Windows\system\iPZyUgr.exe

Filesize
1.9MB

MD5
99868365ce1f0ab2ef7fdc491d111823

SHA1
e1a15e2b408ab2cd4b742cd59a285eff068e8601

SHA256
f52c1321a8741201737119145e94da7a7f18eb767cdc185593bf2b4a9ab47e8d

SHA512
b1c9ac38a4c8cef172d8856f0d91c3f238cba5c4ebd5a47c4f1bb761ae05b31888ba7bdc08b8a14c73b1839ab6b7d8020f20e64b2cf1d091df9238d71d124d8e

Download Submit
C:\Windows\system\iREGwDI.exe

Filesize
1.9MB

MD5
f30463bc2ca6ae447a430039bb0fe783

SHA1
950eeb8c4e42f3e3a6a7e9da1ceae12f014cc357

SHA256
4bbe23637240d3dabccf355bd9de241078827dc032b3179b33f5814b2de74b48

SHA512
7f1c528705e0de3161c4a44470492df13cb9cf995bab4d38c1ade5a21257be5e8577910572a7987552ce2bc9e5de95625f4af9e01196b97f2fc34f833dae5b13

Download Submit
C:\Windows\system\kTFZxll.exe

Filesize
1.9MB

MD5
f2722b90a652b48ae73b387bb0b5a22d

SHA1
5596302e37e308144dfd611970d919a7919f6367

SHA256
64ecfa1ee97fc5202daca4a9285fb60c3e4c5a1b270b9978dd8f19d852f4a82a

SHA512
df5da40fb9ae35d371289ebfefc239c91cf957592e5d68ad6e72a66d924c107c6926ca0a07eb99f5464dde0bce04b89c69b31e82caf83f1052812be66c85546d

Download Submit
C:\Windows\system\pFaMHdh.exe

Filesize
1.9MB

MD5
ca8348f5e739a021a7a73b7760d5ad8c

SHA1
152ac3c5bcc71b0d70a30c7dfd6b489067365c52

SHA256
6b049d2dc3987ba2ec9b62ccbe3414f527176ae9f3f1f3dde4264ebb5443d12f

SHA512
60d6036ffa5210b1db7c6e99d500adb3df7f5af57fb4cf5b12de5835c61d2780d36e0b8812183fafc8b8eaf3173078021d78a09a4aa694fa9848234637a186ca

Download Submit
C:\Windows\system\rBZyexY.exe

Filesize
1.9MB

MD5
5d17b000d56d6e0493653b0e18781551

SHA1
4d2b41cd5d360084c8e7c428b07ab2eaf4cbdb0e

SHA256
276aa9133eddc1a9a05ef144fc0788a0274546fe894bf0d4a9f3bde2b924c270

SHA512
a8b2e295f3bd78fb89bd2ee6e1bf3d48d1ac3bda219021400f9fc6af7401b40f7f548eae634ff1726cc4f67678eee3e39dd607bdf61b11a3a3f11aeedb1b1b00

Download Submit
C:\Windows\system\zjVgjUx.exe

Filesize
1.9MB

MD5
1fd550a158bd9c2a95422f05913b80ed

SHA1
85e11cf5baa0b6574048ffd8d21289fad8ff2d01

SHA256
ab67203ae500c7b5ba635b09df58643db72cf7b3659b0b46e2c0c5856bd4ab36

SHA512
632964b66481d02b9afe1783158abef6f54b1ab109a11a73a452412a8373fff3f91328d1d6d2d7c03bcaa0be5e731dd89c2e03adc1476b687aef81a6e99e0c24

Download Submit
\Windows\system\BCTGedm.exe

Filesize
1.9MB

MD5
7a4d84822223a99b0b4d10ab66410eac

SHA1
6fb033f11ad30dc594a52779d3e1b723a585d467

SHA256
997af4feaf05ad35d890ce00997be5f8518f1a4bb427c537aea502f3acaef251

SHA512
8bc06ac722c9cee1aa9e2679e191ff5d76e78ae7bb8b68063abe9b68d0361beeee7acad0b94d57aa230667a1776313377cf63f96b5106c27f5f35a63c4fbd72c

Download Submit
\Windows\system\BaHkhVG.exe

Filesize
1.9MB

MD5
38a2411d62441db3e0f219c320b462f1

SHA1
b3e91de0e7e4d6dc3d1b0522eddfa07ae44e12ff

SHA256
c691ab36207b5a4ff618835519d5507d597e1a9e28ec5cf4b39633f16f8f5e7b

SHA512
e2018d188130a1b43277647538c7edc74c72f73759737fa7d3928d5df9f753dad4e63aa73ff37cd6f1e445eee2e3658c257f6fd9e4de0c7c10a0c4d715f2bf70

Download Submit
\Windows\system\TkpeTsx.exe

Filesize
1.9MB

MD5
a676d8c5e6bcc3c0cdcf86326a6ada47

SHA1
4f7c85914013b0dd8aa2f9ae7a7ece9b3b38f370

SHA256
7d74b512e7230bcec2eb742dff106b7688df798f7d26cc456fb55748f3f5160d

SHA512
75483e934d71c6563e3dc008d8be5688c6d18ab7efb81ad17862ce1bff7b7c531f6c5382b364fc660c768d12e2d4a2af6c4cdb4752235a018fe1818c103fa791

Download Submit
\Windows\system\ZJNpYhH.exe

Filesize
1.9MB

MD5
e164a206fef2c4e7c65ce0d192875a50

SHA1
22295f39423541f470c46a36173aa821c9c0c867

SHA256
d43714f45964e96cab5799234ad0164964d5412c1415f57584dbc19ee6ed6e5f

SHA512
bb6ccd8838abe21fb16b37830393ef65dc7320e0d282192dfb731db400f6960dfa68415cc18c4241e555cfdb3eefddf91eae881594e6ac0c8aa45716cab43366

Download Submit
\Windows\system\gdsDXJj.exe

Filesize
1.9MB

MD5
1ccf4fd60ff181a06873ace2df08e082

SHA1
22a56193fc17eab63d16338b9cbce1c6f8804751

SHA256
4fdbf38995c98fb6b45fec9fa3844a77d2d173f32735a200238187c4c9b321a5

SHA512
13448d39e2ea9f59e208f136c2703981f5a94268fa6de30cfe0e4f22ab957d4077b961dfe3dcafb98810983f15cca813bd9aa01a0381aa9bf3a20c4d376fbfe1

Download Submit
\Windows\system\jomEarg.exe

Filesize
1.9MB

MD5
3bda82609f6745dccb2bd9b7ba01bf21

SHA1
64ad1d5d89b6d11ab62f262a510ea816afe44e58

SHA256
19eaf027b63622b5047950e7d0c0008c0a0f01ad1da8016f935a0b3c469abb09

SHA512
2b091c16863e53c91906ce1c3fe478628f2dff87320ea4681047c2ed921626a051132c8ac3ee78844a14eb1ad5aefe64e328d67c196547af9fcaa3307113b0ed

Download Submit
\Windows\system\uTlDCcg.exe

Filesize
1.9MB

MD5
a2a96b699d2f93b94eb01315c008203c

SHA1
61c115ef09f83db03e68413e90023db5a6ec1886

SHA256
06db75f1866d7824d32f861684c22957137c547a3933072c2eeba7ad0c5d3998

SHA512
5f9834d7c5e798ef37906a9e69aeb470a13d9f60741ff04924b434dec73f4dbfffe62a442eac9c54ad20915e3390f41cf6c75d180ab966a3dec3147be4ddf50f

Download Submit
\Windows\system\ulcNSNb.exe

Filesize
1.9MB

MD5
e69bd72971cbf5b4f431a380a72561c3

SHA1
9730b70e4d360bcd6dfd5c7b293671cbeb48f1e7

SHA256
5823901b54eaa318a7d7db723c0a27eaa80520c5f876014914601750675ba9ef

SHA512
4f9c13cd413a98be70fdb5f7274c07d174ba94d4ca6926a443f6d7c93641d359b3b96531c747143fec9888facff14ff6f612c6eab72bc48c6240b5d484bd0237

Download Submit
memory/1300-106-0x0000000000370000-0x0000000000378000-memory.dmp

Filesize
32KB

Download
memory/1300-79-0x000000001B880000-0x000000001BB62000-memory.dmp

Filesize
2.9MB

Download
memory/1732-2438-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1732-73-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1996-59-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1996-50-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/1996-2431-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1996-20-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-88-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-87-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1996-18-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/1996-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1996-8-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/1996-80-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/1996-42-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/1996-78-0x0000000003620000-0x0000000003A12000-memory.dmp

Filesize
3.9MB

Download
memory/1996-69-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/1996-26-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-28-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/1996-470-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1996-48-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download
memory/2200-21-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2472-47-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2504-52-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2540-29-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2624-54-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2624-1914-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2636-30-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-27-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-89-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/2856-82-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2972-90-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2984-61-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2984-1929-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download